TFG London breach: personal data accessed at Phase Eight, Hobbs and Whistles
TFG London, owner of Phase Eight, Hobbs and Whistles, emailed customers on October 28, 2026 confirming that some personal data was accessed in the cyber attack it identified on October 11; the data may include contact and delivery details, order information and, in some cases, the last four digits of a payment card, and the company says it has found no evidence passwords were accessed.
What happened
TFG London, the UK arm of South African retail group The Foschini Group, identified a cybersecurity incident affecting some of its IT systems on Sunday, October 11, 2026. The systems affected serve three of its fashion brands — Phase Eight, Hobbs and Whistles. The company acted to secure its systems, brought in independent cybersecurity specialists and notified the relevant authorities; its stores stayed open while some systems and online services were disrupted. In its first statements, the company said the investigation was still establishing whether any personal information had been compromised, and that it would contact customers directly if personal data was found to be involved. The October 28 email is that contact — now sent to all customers, ahead of the investigation finishing.
On October 28, 2026, chief executive Justin Hampshire emailed customers with the investigation’s first confirmed finding on data: “some personal data has been accessed.” The company is contacting all of its customers as a precaution, and it stresses that being contacted does not necessarily mean a customer’s own information was affected. The investigation into exactly which information was accessed is continuing, and the company says it will keep its online FAQ page updated. Its other UK brands, White Stuff and Inside Story, were not affected, and the group’s operations in Africa and Australia run on separate systems.
Who is affected
Customers of Phase Eight, Hobbs and Whistles. TFG London has not disclosed how many people are affected, and because it is writing to every customer as a precaution, receiving the email does not confirm that your details were among those accessed. The company says the information that could be affected includes contact and delivery details and order information, and in some cases limited payment information — the last four digits of a payment card. It emphasised that this does not include usable payment card details, because payment processing is handled by a third-party provider. So far, the investigation has not found evidence that account login information or passwords were accessed — a finding the company notes remains subject to its continuing investigation.
How serious
The concrete risk is targeted phishing and impersonation. Contact and delivery details paired with real order information let scammers send emails, texts or calls that claim to be from Phase Eight, Hobbs or Whistles and get the details of a genuine order right, then push the customer to pay again, “confirm” card details or hand over a password. A card’s last four digits alone cannot be used to spend on the card, and the company says usable card details and passwords were not accessed — so direct card fraud and account takeover are not the risks this incident creates on the facts confirmed so far. The risk is a convincing fake message built on real details. That is also the company’s own warning: TFG London advised shoppers to remain alert to unexpected contact precisely because the compromised information could be used to make fraudulent communications appear more convincing.
What to do now
TFG London says customers do not need to take any immediate action, but should stay alert to unexpected emails, calls and text messages. The company reminded customers that Phase Eight would never ask for passwords or full payment card details by email, text or telephone — treat any message that does as a scam, however accurate its order details look. If a message about an order or a refund asks you to click through and pay or sign in, go to the brand’s official website or app yourself rather than using the link in the message. Keep an eye on the statements for any card whose last four digits may be involved, and report anything you do not recognise to your card provider.
Sources: Drapers, October 29, 2026, reporting TFG London’s October 28 customer email · Retail Gazette, October 29, 2026