On Sunday 11 October, TFG London, the UK business behind Hobbs, Whistles and Phase Eight, found that some of its IT systems had been hit by a cyber attack. Two days later, several systems were still offline and some online orders were running late. But the shops stayed open and card payments kept working. That second half of the story is the part every small business should pay attention to.
What happened
TFG London is the UK arm of South African retailer The Foschini Group. It disclosed the incident on 13 October, two days after spotting it. The company says it activated its incident response and business continuity plans, brought in outside cyber security specialists and told the UK authorities. The Information Commissioner's Office (ICO) confirmed to The Register that it had received a breach report and is assessing it.
Stores are trading as normal. Some website functions are unavailable, and an email seen by The Telegraph warned that orders placed from 11 October may be delayed.
Card details look safe. Payments are processed by a third-party provider, and TFG says it has "no reason to believe" payment information is at risk.
Other customer data is still being checked. TFG hasn't yet said whether names, addresses or order histories were taken, and will contact anyone affected.
The damage was contained. Sister brands White Stuff and Inside Story weren't affected, and nor were operations in Africa and Australia, which run on separate IT systems.
TFG hasn't said how the attackers got in or whether ransomware was involved. When BleepingComputer reported the story, no criminal group had claimed responsibility.
A busy autumn for UK fashion
TFG is the latest in a run of fashion names in the headlines. Days earlier, ASOS said an attacker had impersonated a trusted contact to get an employee's login details, then used them to reach third-party platforms holding customer names and contact details. H&M is investigating claims it was targeted, but says it has found no sign its systems were compromised. There's no evidence the three incidents are linked.
The stakes are real. After Marks & Spencer was attacked in April 2025, online clothing orders were suspended for seven weeks, and Retail Gazette reports costs directly linked to the incident of £131.3m in the 2025/26 financial year. The Co-op attack the same month saw the personal details of all 6.5 million members stolen.
Why the shops stayed open
We don't have the full picture yet, but from what TFG has said, three things seem to have limited the damage. It had a plan and switched it on straight away. Card payments were handled by a specialist provider rather than its own systems. And its businesses in other regions ran on separate systems, so the problem didn't spread. None of those needs a big budget. They need deciding in advance.
What this means for UK small businesses
Small firms face the same kinds of attack. The government's Cyber Security Breaches Survey 2025/26 found that 42% of micro businesses and 46% of small businesses identified a breach or attack in the last 12 months. Yet only 25% of businesses have a formal incident response plan, falling to 21% of micro businesses. Just 34% have written guidance on who to tell when something goes wrong.
If personal data is involved, the clock is ticking. The ICO's guidance for small organisations says reportable breaches must be reported within 72 hours, and the clock starts when you discover the breach, not when it happened. That's a short window to work out who to call if you've never thought about it.
What to do this week
Write a one-page plan. List who decides what, your IT support's number, your insurer and your bank, and how you'll take orders and payments if your systems are down. The NCSC's Exercise in a Box is free and lets you rehearse it, and you don't need to be an expert to use it.
Know your 72 hours. Start a log the moment something looks wrong. The ICO says you can report with incomplete information and add details later, and its breach advice line is 0303 123 1113.
Keep card details off your own systems. Use a reputable payment provider for your till and website so card data is handled by a specialist, as it was at TFG.
Separate what matters. Give staff their own logins, turn on multi-factor authentication, and keep your till, website admin and back office on separate accounts so one stolen password doesn't open everything.
Expect the scam emails. After any well-known breach, criminals send fake "your order" and "your account" messages. BleepingComputer advised Hobbs, Whistles and Phase Eight customers to stay alert for phishing, and that goes for your staff too.
Sophia Says
What I like about this story is the bit that didn't make the headline: the shops kept trading. That isn't luck. Someone decided, before the attack, how the business would keep going without its systems, and kept card payments well away from them. Most small firms have never had that conversation, and it costs almost nothing.
HackRisk helps you make sure there's less to recover from in the first place. I scan your business from the outside, the same way an attacker would, and tell you in plain English what I find: staff logins leaking onto the dark web, forgotten systems open to the internet, and unpatched software. Then I give you a short list of fixes in the order they matter, so you can sort the obvious gaps before anyone else spots them.
— Sophia, HackRisk AI Security Analyst
Where HackRisk fits
Stolen staff logins: ASOS's attacker got in with an employee's login details. Our Dark Web Scan looks for your business's credentials in breach dumps and criminal markets.
Systems you didn't know were exposed: A Recon Scan maps what attackers can see of your business from the internet.
Unpatched software: A Vulnerability Scan finds known weaknesses in your website and internet-facing systems.
Third-party platforms: Customer data increasingly sits with suppliers. Supply Chain Risk shows how exposed the companies you rely on are.
Impersonation and phishing: Phishing Simulations and Security Awareness Training help staff spot a "trusted contact" who isn't.
Get your free HackRisk report
Find out what attackers can see of your business before they do. Get your free HackRisk report and Sophia will explain the results in plain English, with the fixes that matter most first.
Sources
GOV.UK (DSIT), Cyber Security Breaches Survey 2025/26