The Foschini Group (TFG) disclosed a cyberattack on 13 October 2026 that disrupted IT systems at three of its UK fashion brands: Phase Eight, Hobbs and Whistles. Several systems remained offline while specialists assessed the breach, although stores continued trading.
TFG said it discovered the incident on Sunday. The company then informed investors through the Johannesburg Stock Exchange’s SENS service, according to The Record’s account of the disclosure. The date of discovery and the date of public disclosure are separate; no calendar date was provided for the Sunday discovery.
Disruption is limited to three TFG London brands
The incident affected systems used by Phase Eight, Hobbs and Whistles, all part of the TFG London division. Some services were unavailable, and orders placed around the incident may be delayed.
TFG’s other UK brands, Inside Story and White Stuff, were not affected, according to the company. Its South African and Australian operations were also outside the reported scope because they run on separate IT systems.
That distinction matters given the group’s size: TFG operates nearly 5,000 stores across 18 countries and owns roughly 40 brands in fashion, beauty, jewelry and homeware. The current disruption does not cover that entire footprint.
Data exposure remains under investigation
TFG has not identified the attackers or disclosed how they entered the affected environment. It also has not established whether personal or sensitive information was compromised.
The company reported the incident to the relevant UK authorities and brought in external cybersecurity specialists. It said affected customers or organizations would be notified if the investigation determines that sensitive information was exposed.
TFG has not reported such a finding at this stage. Several systems remained offline during the assessment, but the company did not provide a containment or restoration date.
What customers should do
Customers with orders placed around the incident should expect possible delays and should not submit duplicate orders, according to guidance sent by the company and cited by local media.
TFG said payments are handled by an external provider and that it has no reason to believe payment information is at risk. It is also not asking customers to change their account passwords at this stage. Those positions reflect the company’s current assessment and could change if the continuing investigation identifies additional impact.
