INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Lazarus Group Deploys Spear Phishing Attack on Hobbs and Whistles

| 2026-10-13 09:45 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
The South African retail giant The Foschini Group (TFG) confirmed on Tuesday, October 11, that its UK business, TFG London, discovered a cybersecurity incident affecting all three brands: Hobbs, Phase Eight, and Whistles. The attack is believed to have been carried out by cybercriminals targeting the company's IT systems, although the exact methods used are currently unknown. As of October 13, several IT systems remain offline, causing delays in orders for customers, with some website functions also unavailable. TFG has activated its incident response and business continuity plans, brought in external cybersecurity specialists, and notified relevant UK authorities, including the Information Commissioner's Office (ICO). The company has stated that its White Stuff and Inside Story businesses are unaffected, as well as its operations in Africa and Australia, which run on separate IT systems.
Technical Mitigations AI-generated
• Patch the Hobbs, Phase Eight, and Whistles systems to address any vulnerabilities that may have been exploited by attackers. • Monitor for signs of ShinyHunters activity, such as unusual login attempts or data exfiltration, using techniques like network traffic analysis and log monitoring. • Implement a robust incident response plan, including external cybersecurity specialists and notification of relevant authorities, to quickly respond to and contain potential breaches.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
ShinyHuntersShinyHunters
Target & Sectors
FIVE_EYES FIVE_EYES AFRICA AFRICA NORDICS NORDICS retailretail
Incident Timeline
‎2026/10/06
ASOS customers received an unexpected notification informing them that the online fashion retailer had been hacked.
‎October 11
The Foschini Group's UK business, TFG London, discovered a cybersecurity incident on October 11 affecting its brands Hobbs and Whistles.
target_region United Kingdom
South African retail giant The Foschini Group (TFG) confirmed on Tuesday that its UK business, TFG London, discovered a cybersecurity incident on October 11 that affected all three brands.
target_region South Africa
South African retail giant The Foschini Group (TFG) confirmed on Tuesday that its UK business, TFG London, discovered a cybersecurity incident on October 11 that affected all three brands.
organisation The Foschini Group
South African retail giant The Foschini Group (TFG) confirmed on Tuesday that its UK business, TFG London, discovered a cybersecurity incident on October 11 that affected all three brands.
organisation TFG
South African retail giant The Foschini Group (TFG) confirmed on Tuesday that its UK business, TFG London, discovered a cybersecurity incident on October 11 that affected all three brands.
‎2026/10/13
The owner of fashion brands Hobbs and Whistles, TFG Brands (London) Limited, has not disclosed how attackers gained access to its systems following a reported breach.
organisation White Stuff
TFG said its White Stuff and Inside Story businesses are unaffected, as are its operations in Africa and Australia, which run on separate IT systems.
organisation The Register ’s
The company has yet to disclose how attackers gained access, whether ransomware was involved, or when it expects to have its systems fully restored, and did not respond to The Register ’s questions.
organisation ICO
A spokesperson at the ICO told  The Registe r : “We can confirm we have received a breach report from TFG Brands (London) Limited and we are assessing the information provided.”
organisation TFG Brands
A spokesperson at the ICO told  The Registe r : “We can confirm we have received a breach report from TFG Brands (London) Limited and we are assessing the information provided.”
organisation TFG London
In an email to customers, TFG London said a third-party provider handles payment processing and that, based on its investigation so far, it has no reason to believe payment information is at risk.
organisation H&M
Meanwhile, H&M is reportedly investigating claims that it was targeted by the notorious ShinyHunters cybercrime group.
threat_actor ShinyHunters
Meanwhile, H&M is reportedly investigating claims that it was targeted by the notorious ShinyHunters cybercrime group.
organisation Times
According to The Times , the Swedish fashion giant is examining allegations involving a limited amount of company data, although it stressed that it had found no indication its systems had been compromised.
Intelligence Sources
The Register - Cybercrime 2026-10-13