---
title: "TFG London cybersecurity incident"
description: "TFG London disclosed an October 11 cybersecurity incident affecting Phase Eight, Hobbs and Whistles IT systems."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-10-13"
canonical_url: "https://www.ally.security/incidents/tfg-london-cybersecurity-incident-2026"
markdown_url: "https://www.ally.security/incidents/tfg-london-cybersecurity-incident-2026.md"
stix_url: "https://www.ally.security/incidents/tfg-london-cybersecurity-incident-2026/stix.json"
---

# TFG London cybersecurity incident

Stores remained open while several systems were unavailable and the investigation assessed possible data compromise.

Last modified Oct 13, 2026 · 1 source

## Summary

- **Environment:** TFG London systems serving Phase Eight, Hobbs and Whistles
- **Operational impact:** Several IT systems unavailable; stores reported open
- **Financial impact:** No incident cost established in the reviewed evidence

## What happened

[TFG London](https://www.tfglondon.com/) identified a cybersecurity incident on October 11, 2026, affecting systems at Phase Eight, Hobbs and Whistles. The [issuer’s SENS announcement](https://www2.sharenet.co.za/v3/sens_display.php?scode=\&seq=6\&tdate=20261013070500) disclosed it two days later. [1](#source-1)

## Impact

Stores remained open and trading, but several IT systems were unavailable. The issuer said Inside Story, White Stuff and its African and Australian operations were unaffected. Whether personal or sensitive information was compromised remained under investigation. [1](#source-1)

## Timeline

### October 11, 2026 — Incident identified

The company detected the incident. [1](#source-1)

### October 13, 2026 — Public disclosure

The issuer announced the systems disruption and continuing investigation. [1](#source-1)

### October 13, 2026 — Briefing updated

This briefing was last reviewed and updated on October 13, 2026.

## Threat Group & Attack Vector

The announcement does not establish the initial access method, malware or attacker. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

TFG activated incident-response and continuity plans, engaged external cybersecurity specialists and notified relevant UK authorities. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/tfg-london-cybersecurity-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Cybersecurity incident at TFG London — SENS announcement

official · The Foschini Group Limited (SENS announcement distributed by Sharenet) · Oct 13, 2026

<https://www2.sharenet.co.za/v3/sens_display.php?scode=&seq=6&tdate=20261013070500>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   TFG London cybersecurity incident: Incident detected
2. **Resulted In · 100% confidence · current**  
   TFG London cybersecurity incident: The group activated response and continuity plans, retained external cybersecurity specialists and reported the incident to relevant UK authorities.
3. **Resulted In · 100% confidence · current**  
   TFG London cybersecurity incident: The investigation had not established whether personal or other sensitive information was compromised.
4. **Resulted In · 100% confidence · current**  
   TFG London cybersecurity incident: The issuer said Inside Story, White Stuff, TFG Africa and TFG Australia were not affected; the African and Australian operations used separate systems.
5. **Resulted In · 100% confidence · current**  
   Incident detected: TFG London identified the cybersecurity incident.
6. **Affected Organization · 100% confidence · current**  
   TFG London cybersecurity incident: TFG London
7. **Resulted In · 100% confidence · current**  
   Issuer publishes SENS announcement: The Foschini Group disclosed the incident and continuing investigation.
8. **Occurred At · 100% confidence · current**  
   Incident detected: 2026-10-11
9. **Resulted In · 100% confidence · current**  
   TFG London cybersecurity incident: The issuer said stores remained open and trading while several IT systems were unavailable.
10. **Occurred At · 100% confidence · current**  
   Issuer publishes SENS announcement: 2026-10-13
11. **Discovered At · 100% confidence · current**  
   TFG London cybersecurity incident: 2026-10-11
12. **Resulted In · 100% confidence · current**  
   TFG London cybersecurity incident: TFG London identified an incident affecting IT systems at Phase Eight, Hobbs and Whistles.
13. **Resulted In · 100% confidence · current**  
   TFG London cybersecurity incident: Issuer publishes SENS announcement

</details>