The Foschini Group (TFG) has disclosed a cyberattack on its UK business, TFG London, which has knocked out several IT systems at three fashion brands: Phase Eight, Hobbs and Whistles. The JSE-listed retailer told investors in a SENS announcement on 13 October 2026, as reported by Moneyweb.
TFG London identified the incident on Sunday, 11 October. Its stores remain open and trading, “although several of its IT systems remain unavailable”, according to TechCentral.
What TFG has said
TFG activated its incident response and business continuity plans, and TFG London has engaged external cybersecurity specialists to contain the incident. It has also reported the matter to the relevant UK authorities.
Two of TFG London’s five brands, Inside Story and White Stuff, were not affected. TFG Africa, which includes Foschini, Markham and @home, and TFG Australia run on separate systems and are not affected.
The investigation is still under way, including whether customer or other sensitive data was compromised. If it was, TFG says “TFG London will notify affected individuals or organisations, as appropriate”. The board has said it will make a further announcement if there are material developments.
TFG has not said what kind of incident it is, how the attackers got in or who may be behind it. BleepingComputer reported that it found no threat actor publicly claiming the breach, and that TFG London has not confirmed any customer data exposure. It advised customers of the three brands to stay alert for phishing and social engineering.
What customers have been told
The Record, the news site of cybersecurity firm Recorded Future, reported that orders placed around the time of the incident may be delayed and that customers should not place duplicate orders. Payments are handled by an external provider, and TFG said it has “no reason to believe payment information was at risk”. Customers do not need to change their account passwords for now, according to The Record.
The business behind the brands
TFG London has become a significant part of the group since TFG bought White Stuff in October 2024. TechCentral reports that its retail turnover rose 29.4% to £488 million in the year to 31 March 2026, but that it posted an operating loss of £21 million, partly because of an impairment (a writedown in the value of an asset) at Phase Eight, a figure it attributes to the trade title Drapers.
The Record said TFG London reported a drop in earnings of more than 65% in the same period, and that a cyber incident at “a key online concession partner” earlier in 2026, which affected online sales, was among the contributing factors. It added that there is no indication the earlier disruption is linked to the current attack.
The group is much larger than its UK arm. BusinessDay reports that TFG operates 4 914 stores in 18 countries, including 3 432 in South Africa. In June 2026 the group said it planned to close 100 underperforming stores and reduce inventory purchases, expecting another subdued year in South Africa. It has identified about 300 underperforming stores in all, with closures to happen only after efforts to improve their performance are exhausted.
Other retailers have been hit
The attack follows a run of incidents at UK and European retailers. TechCentral notes that attacks on Marks & Spencer, the Co-op Group and Harrods in 2025 prompted the British government to warn companies that cybersecurity must be an “absolute priority”.
The Record lists more recent cases. Fashion retailer ASOS said earlier in October that attackers had impersonated a trusted contact to compromise an employee account and sent an unauthorised push notification to customers. In August, Levi Strauss and De Bijenkorf also reported cybersecurity incidents.
For TFG, the open questions are how long the affected systems stay down, whether customer data was taken, and whether the disruption becomes material enough to trigger the further announcement the board has promised. The company has not given a cost estimate or a timeline for restoring the systems.
