TFG cyber-attack disrupts Hobbs, Whistles and Phase Eight

TFG has suffered a cyber-attack affecting its London operations, disrupting website functions and order processing at fashion brands Hobbs, Whistles and Phase Eight after discovering a breach on 11 October. The South African retail group has not disclosed a financial cost.

The affected brands’ shops remain open. White Stuff and the group’s other brands were not affected, leaving the reported disruption concentrated in part of its UK fashion business.

What happened

TFG said some of its IT systems had been breached and that it had notified the relevant authorities. It said it had no grounds to believe payment information was at risk, although that assurance does not establish the full extent of the intrusion.

The incident, reported by InternetRetailing, emerged alongside a separate investigation at H&M and an attack on refrigeration systems at French food retailers. The cases involve different reported consequences: interrupted retail services, allegations of data theft and the destruction of stock.

H&M is examining claims that it was targeted by ShinyHunters. In a statement to BBC News, the fashion retailer said it knew about allegations circulating online but had not found evidence that its data environment had been compromised. The claims therefore remain distinct from TFG’s confirmed breach.

On 12 October, attackers raised refrigerator temperatures at hundreds of Intermarché shops and Coopérative U outlets in France. Food worth hundreds of thousands of pounds spoiled and had to be discarded.

That attack extended the impact beyond customer information or website availability. By interfering with equipment used to keep products saleable, the intruders caused physical stock losses and exposed a potential threat to food security.

The background

The incidents followed an attack involving ASOS a week earlier. Thousands of customers and mobile app users received a pop-up message claiming that attackers had gained control of the retailer’s Snowflake instance, referring to its use of the data storage platform.

The message demanded that ASOS engage with the attackers and threatened a leak. It appeared to concern customer data, but the scope of access described in the message was an assertion by the hackers, not a finding confirmed by the retailer.

ASOS said customer passwords and credit card information had not been affected. Its investigation was continuing, with the reported disruption also demonstrating how attackers could put their demands directly in front of customers rather than communicate only with the company.

A newly emerged group calling itself Xuanye claimed responsibility. The same group also claimed involvement in a recent attack on Air France-KLM; that claim does not establish a connection between the other retail incidents.

The account of the ASOS incident said the attackers used artificial intelligence to obtain customer data through Snowflake. They reportedly set a two-week deadline for payment before releasing the information. No exact expiry date was given, and no ransom payment by any of the affected businesses was confirmed.

Figures from cyber-insurance business Coalition put the proportion of targeted firms paying a ransom in 2025 at about 14%. That industry figure is not evidence that TFG, H&M, ASOS or the French retailers paid their attackers.

Separately, SQ Magazine reported that 68% of US ransomware victims in 2025 suffered another attack within six months. Its report also put retail’s share of attacks at 3.6%. Those measures cover different populations and do not provide a UK retail-specific probability of a repeat incident.

The operational threat comes alongside wider commercial pressure, with European retail distress reaching a post-crisis high. In the UK, Marks & Spencer and John Lewis have also pressed for Budget tax relief, reflecting a separate set of pressures on the sector.

What people are saying

Samuel Hassine, chief executive and co-founder of threat management platform Filigran, said retailers’ exposure was linked to the credentials, technology platforms and suppliers they shared. His assessment focused on routes that could allow a problem at one business to become a risk for another.

He said attackers could reuse stolen login details and exploit common third-party connections without needing to devise a fresh method for every brand. Monthly security reviews, in his view, could not keep pace with that movement between potential targets.

Hassine urged security teams to establish which credentials were already circulating, identify partners with access to customer information and check exposed application programming interfaces that still accepted a password without a second verification step. His proposed starting point was existing access, rather than waiting for another allegation to emerge.

He also called for retailers to test those access routes using the methods seen in current attacks, repair weaknesses and share findings promptly across the sector. The emphasis was on practical testing and information exchange between businesses with overlapping suppliers and systems.

The security debate is distinct from retailers’ preparations to serve customers using AI. H&M’s SEO lead has urged the sector to prepare for AI shoppers, illustrating the technology’s separate implications for customer acquisition as well as security.

What happens next

The government said on 12 October that it was preparing Britain for serious incidents involving AI agents. It indicated that legislation could be used to protect critical infrastructure against AI-powered cyberthreats, but no timetable or detailed measures were set out in the account.

At company level, H&M’s next task is to determine whether the allegations reflect an actual compromise, while ASOS continues to examine its incident. TFG has not provided a timetable for restoring the affected website functions and order processing, leaving the duration of that disruption unresolved.