INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Hobbs and Whistles Retailers Hit by TFG London Cyberattack

| 2026-10-13 16:44 CRITICAL LOW DATA BREACH DDOS & DISRUPTION
JSON
Executive Summary
AI-generated
On October 11, 2026, TFG London, the UK subsidiary of South Africa's The Foschini Group, detected a cybersecurity incident that impacted IT systems used by its premium fashion brands Phase Eight and Hobbs. Several IT systems remain unavailable, although physical stores in Australia and Africa remain open for customers. The company has not affected its other brands, Inside Story and White Stuff, or operations in these regions. TFG London is investigating whether any customer information was compromised after attackers used social engineering to steal an employee's login credentials, gaining unauthorized access to customer data. As of now, no threat actor has publicly claimed the breach, but clients of Phase Eight, Hobbs, and Whistles are advised to remain alert for potential phishing attacks.
Technical Mitigations AI-generated
• Account Use Policies (ATT&CK mitigation for Social Engineering): Adds verification for helpdesk resets, approvals, and app consents commonly targeted by impersonation. • Audit (ATT&CK mitigation for Social Engineering): Enables correlation of email/identity/SaaS/endpoint activity that appears legitimate. • Network Intrusion Prevention (ATT&CK mitigation for Phishing): Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity. • Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
ShinyHuntersShinyHunters
Target & Sectors
FIVE_EYES FIVE_EYES AFRICA AFRICA NORDICS NORDICS retailretail
Incident Timeline
‎October 11
Threat actors used an unspecified method to target Hobbs and Whistles retailers, prompting the company to activate its incident response plans.
‎2026/10/13
Threat actors used an unspecified method to target Hobbs and Whistles' IT systems, resulting in several systems remaining unavailable.
‎2026/10/13
Threat actors used social engineering to steal an employee's login credentials and gain unauthorized access to customer data at TFG London.
organisation The Foschini Group
TFG London is the UK subsidiary of South Africa’s The Foschini Group, which owns the aforementioned five fashion and homeware brands.
organisation Phase Eight
At this time, TFG London has not confirmed any customer data exposure, but clients of Phase Eight, Hobbs, and Whistles are advised to remain alert for potential phishing and social engineering attacks.
organisation BleepingComputer
BleepingComputer could not find any threat actor publicly claiming the TFG London breach.
organisation H&M
Earlier this week, rumors emerged about an attack at Swedish multinational clothing company H&M, claimed by an attacker saying they were with the ShinyHunters group and threatening to leak stolen data.
threat_actor ShinyHunters
Earlier this week, rumors emerged about an attack at Swedish multinational clothing company H&M, claimed by an attacker saying they were with the ShinyHunters group and threatening to leak stolen data.
organisation NFL
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
organisation CHANEL
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
‎mid-2026
Threat actors targeted Hobbs and Whistles retailers globally, disrupting systems at 649 retail locations as of mid-2026.
general_metric 649 retail locations
As of mid-2026, the group operated 649 retail locations globally and reported annual sales of £488 million ($646M).
Intelligence Sources
BleepingComputer 2026-10-13