Hobbs and Whistles owner confirms customer data accessed in cyberattack

The owner of fashion brands Phase Eight, Hobbs and Whistles has confirmed that customer and employee personal data may have been accessed in a cyberattack earlier this month.

South African retail group The Foschini Group (TFG) said its UK subsidiary, TFG London, identified the cybersecurity incident on 11 October, affecting some of its IT systems.

In a statement provided to TheIndustry.fashion, TFG London said: “As part of our investigation, we found that some customer and employee personal data may have been accessed and have informed customers and employees directly.”

The company added: “We are very sorry for any worry this incident may cause, and we thank our customers for their patience and continued support.”

TFG London said the investigation was ongoing to establish exactly what data may have been accessed.

The company initially disclosed the incident on 13 October, saying certain IT systems used by Phase Eight, Hobbs and Whistles had been affected. At the time, it said there was no reason to believe payment information was at risk.

In its latest statement, TFG London said it had acted immediately to secure its systems, brought in independent cybersecurity specialists and notified the relevant government authorities. It added that all its brand websites were fully operational and accepting online orders and returns.

TFG London owns Phase Eight, Hobbs, Whistles, homeware brand Inside Story and lifestyle retailer White Stuff. The group said White Stuff customers were not affected by the incident.

The incident follows a separate cyberattack at online fashion retailer ASOS, which confirmed earlier this month that customer information may have been accessed through third-party platforms after an attacker obtained an employee’s login credentials.

Retailers have faced growing scrutiny over the security of customer information held across their own systems and third-party services, with incidents potentially exposing shoppers to follow-up scams and fraudulent communications.