Incident BriefingsTFG London cybersecurity incident

TFG London cybersecurity incident

Stores remained open while several systems were unavailable and the investigation assessed possible data compromise.

Last modified

Summary

  • Environment: TFG London systems serving Phase Eight, Hobbs and Whistles
  • Operational impact: Several IT systems unavailable; stores reported open
  • Financial impact: No incident cost established in the reviewed evidence
  • Record status: Developing record. Reviewed October 13, 2026; updated as evidence emerges.

What happened

TFG London identified a cybersecurity incident on October 11, 2026, affecting systems at Phase Eight, Hobbs and Whistles. The issuer’s SENS announcement disclosed it two days later. [1]

Impact

Stores remained open and trading, but several IT systems were unavailable. The issuer said Inside Story, White Stuff and its African and Australian operations were unaffected. Whether personal or sensitive information was compromised remained under investigation. [1]

Timeline

  1. Incident identified

    The company detected the incident.

    [1]

  2. Public disclosure

    The issuer announced the systems disruption and continuing investigation.

    [1]

  3. Briefing updated

    This briefing was last reviewed and updated on October 13, 2026.

Threat Group & Attack Vector

The announcement does not establish the initial access method, malware or attacker. [1]

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

  • No specific MITRE ATT&CK technique is currently mapped for this case.

Response

TFG activated incident-response and continuity plans, engaged external cybersecurity specialists and notified relevant UK authorities. [1]