Phase Eight, Hobbs and Whistles owner discloses a cyber incident a week after Asos
TFG London identified a cybersecurity incident on Sunday 11 October that hit IT systems at Phase Eight, Hobbs and Whistles. TFG says it has no reason to believe payment information is at risk, and the Independent counts it as the second UK retailer hack in a week.
The Watch · Security desk
Stores open as normal; some brand website capabilities may be unavailable. TFG sees no reason to believe payment information is at risk. Inside Story, White Stuff, TFG Africa and TFG Australia not affected. TFG reported it to UK authorities and works with external specialists.
- constraint Stores and brand websites Stores open as normal; some website capabilities may be unavailable as the investigation continues, claim 3
- exposure Payment information TFG says there is no reason to believe payment information is at risk, claim 2
- exposure Inside Story, White Stuff Not affected; TFG says its TFG Africa and TFG Australia operations were not affected, claim 5
- decision Relevant UK authorities TFG says it reported the incident to them, claim 7
- capability External specialists TFG London says it is actively investigating and working with external cyber security specialists, claim 9
| Who | How | Kind | Claim |
|---|---|---|---|
| Stores and brand websites | Stores open as normal; some website capabilities may be unavailable as the investigation continues | constraint | 3 |
| Payment information | TFG says there is no reason to believe payment information is at risk | exposure | 2 |
| Inside Story, White Stuff | Not affected; TFG says its TFG Africa and TFG Australia operations were not affected | exposure | 5 |
| Relevant UK authorities | TFG says it reported the incident to them | decision | 7 |
| External specialists | TFG London says it is actively investigating and working with external cyber security specialists | capability | 9 |
What happened
- Stores are open as normal, but TFG London said some website capabilities for its brands may be unavailable while the investigation continues.
- Inside Story and White Stuff are not affected, and TFG said its operations in TFG Africa and TFG Australia were also untouched.
- A week earlier, Asos disclosed unauthorised access to some personal data, among it names and contact details.
- On Monday it was reported that H&M was investigating claims that a cybercriminal had targeted it the previous week.
Why it matters
- exposure Shoppers at Phase Eight, Hobbs and Whistles are the people affected now: stores trade normally, but some web functions may be down until TFG finishes its investigation.
- contradiction The Asos phone alert pointed at Snowflake and Snowflake denies a platform flaw, so the one proposed shared supplier does not currently tie these incidents together.
- constraint The one-week framing is a timing observation. With no common actor, method or supplier on the record, defenders have no shared indicator to hunt for across Asos, TFG and H&M.
The Independent calls this the second hack to hit a UK retailer in a week [12]. The two disclosures describe different things. Asos spoke of unauthorised access to personal data [4]. TFG London describes an incident affecting some of its IT systems [1].
The one outside party named so far is Snowflake, and it has pushed back. Asos customers received a phone alert saying the retailer had been hacked [6]. The alert pinned the problem on a compromise at Snowflake, a data storage firm [6]. Snowflake later said the breach did not stem from any vulnerability or flaw in its platform [8].
H&M is the third name in the record, and its position is the weakest. The Times reported that H&M said it was looking into a potential cybersecurity incident made by a group called Shinyhunters [11]. That is a claim under investigation, relayed second-hand. The Independent's report does not say what was accessed at TFG, who is behind it, or whether any of the three incidents are connected.
TFG's own account is short. TFG London said: "We are actively investigating and working with external cyber security specialists." [9] It has reported the incident to the relevant UK authorities [7]. Its statement on payment information is a belief held while that investigation is open, and TFG can revise it.
In our view the record supports three separate incidents reported within about a week of each other. Calling them a campaign needs a shared actor, method or supplier. The only supplier named has denied a platform flaw [8].
What to watch
- Whether TFG London says what, if anything, was accessed and when the Phase Eight, Hobbs and Whistles website capabilities return.
- Whether H&M confirms the Shinyhunters claim, and whether that group or any other is tied to the Asos or TFG incidents.
- Whether Asos or Snowflake publish more on the Snowflake claim in the Asos phone alert.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence70
- Adoption
- Insufficient
- Hype gap+12
- Incentives55
- Confidence68
Perspective Coverage
8 publishers- Builder
- Builder 10%
- Operator
- Operator 56%
- Investor
- Investor 34%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
TFG London identified a cybersecurity incident on Sunday 11 October affecting some of its IT systems, specifically its Phase Eight, Hobbs and Whistles brands.
- [2]
TFG said there is no reason to believe that payment information is at risk.
- [3]
TFG London said stores are open as normal but some of its brands' website capabilities may not be available as the investigation continues.
- [4]
A week before TFG's disclosure, Asos said an "unauthorised party" had gained access to some personal data, including names and contact details.
- [5]
Inside Story and White Stuff are not affected, and TFG said its operations in TFG Africa and TFG Australia were not affected.
- [6]
Asos customers received a phone alert saying the retailer had been hacked, which claimed the data storage firm Snowflake had been compromised.
- [7]
TFG said it had reported the incident to the relevant UK authorities.
- [8]
Snowflake later said the breach was not caused by a vulnerability or flaw with its platform.
- [9]
TFG London said: "We are actively investigating and working with external cyber security specialists."
- [10]
On Monday it was reported that H&M was investigating claims it was targeted by a cybercriminal the previous week.
- [11]
The Swedish fashion giant H&M said it was looking into a potential cybersecurity incident made by a group called Shinyhunters, The Times reported.
- [12]
The Independent described the TFG incident as the second hack impacting a UK retailer in the past week.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
8 independent publishers whose own reporting we read for this story.
- bbc.co.ukPhase Eight and Hobbs owner hit by cyber-attack, as H&M probes separate hack claim
1 article · October 13, 2026
- bleepingcomputer.comTFG London cyberattack disrupts systems at Hobbs and Whistles retailers
1 article · October 13, 2026
- channelnewsasia.comSouth African fashion retailer Foschini Group's UK arm hit by cyber incident
1 article · October 12, 2026
- independent.co.ukHobbs and Whistles owner struck by cyber attack
2 articles · October 13, 2026
- infosecurity-magazine.comEuropean Retail Firms Confirm Cyber Incidents
1 article · October 13, 2026
- itpro.comAnother major fashion retailer hit by cyber attack
1 article · October 13, 2026
- theguardian.comHobbs and Whistles owner investigates hack that may have exposed customer data
1 article · October 13, 2026
- therecord.mediaSouth African clothing retailer Foschini Group investigating cyberattack on British fashion brands
1 article · October 13, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Social Engineering and Voice PhishingFollow
- Retail cybersecurityFollow
- Data BreachesFollow