UK retail cyber attack 2026: Hobbs and Whistles owner hit
TFG London, owner of Hobbs, Whistles and Phase Eight, is the second UK retailer in a week to report a hack. Here is what is known about the data involved and what shoppers should do.
Key points
- TFG London identified a cybersecurity incident on Sunday 11 October affecting Phase Eight, Hobbs and Whistles; it says there is no reason to believe payment information is at risk.
- Asos confirmed on 8 October that names, addresses, phone numbers and search histories were accessed, but not payment card details or passwords.
- H&M is investigating claims about a cybercriminal group, according to The Times.
- Shoppers should be wary of unexpected calls, texts and emails claiming to be from retailers.
The owner of Hobbs, Whistles and Phase Eight has been hit by a cyber attack, the latest UK retail cyber attack of 2026 to involve major brands. TFG London, the UK arm of South Africa’s The Foschini Group, said it identified a “cybersecurity incident” on Sunday 11 October that affected some of its IT systems. It said there was “no reason to believe that payment information is at risk”.
The Independent reported that it is the second hack on a UK retailer in a week, after Asos. None of the sources describes the incidents as linked.
Cyber attack on high street shops: what TFG London has said
TFG London said it was “actively investigating and working with external cybersecurity specialists” and had reported the incident to the relevant UK authorities. Its other brands, including Inside Story and White Stuff, were not affected, and neither were the group’s operations in Africa and Australia.
Stores are open as normal, but some website capabilities for the three brands may be unavailable while the investigation continues. Orders placed before Sunday will be processed and delivered as normal. Orders placed after Sunday may be delayed, though customers do not need to resubmit them. Returns can be made in store, and the company said it was working on a solution for postal returns.
TFG London has more than 3,000 employees and entered the UK market in 2015 by buying Phase Eight. It added Whistles, Hobbs, Inside Story and White Stuff later.
Other retailers in 2026: Asos and H&M
The Asos case shows what a breach can involve even when payment details are not taken. Customers received a push notification on Tuesday 6 October titled “Asos hacked”. Two days later, after a “detailed, 48-hour investigation”, Asos confirmed that names, delivery and email addresses and phone numbers had been accessed, along with some account-related information understood to include recent search histories. It said payment card details and passwords had not been accessed.
Asos said the attacker impersonated a “trusted contact” to obtain an employee’s login credentials, then used them to reach third-party platforms. Its shares fell by more than 14% at one point on the day and closed down 9.56%, according to The Guardian.
Separately, The Times reported that H&M was investigating claims it was targeted by a group called ShinyHunters. H&M has said it is looking into a potential incident.
| Retailer | What has been said | Payment data |
|---|---|---|
| TFG London | IT systems at Phase Eight, Hobbs, Whistles affected | “No reason to believe” at risk |
| Asos | Names, contact details and some account-related information accessed, Asos said | Not accessed, Asos said |
| H&M | Investigating claims | Not stated |
What happens next for shoppers and retailers
TFG London said it would update customers as appropriate. Asos pledged to contact customers directly once its investigation was complete and where further action might be needed. Neither company has given a date.
The main near-term risk is phishing. Simon Phillips of CybaVerse said search data could let attackers send “highly convincing scams” disguised as the reminder emails Asos normally sends. Lisa Barber of Which? said shoppers should be “especially wary of unexpected phone calls, texts, messages and emails” in the coming weeks and months.
The pressure on retailers is not new. The Guardian noted that Marks & Spencer, the Co-op and Harrods suffered cyber incidents last year, with M&S shutting its website for several weeks.
Your questions answered
What to do if you’re a victim of a data breach?
Asos told customers not to share passwords, security codes or payment details in response to unsolicited messages or calls. Which? advised that if you are unsure who you are speaking to, you should end the conversation and contact the company directly.
If a caller may be a fraudster, Which? said you can dial 159 to reach your bank’s fraud team, or use the number on the back of your card. Wait at least 15 minutes before calling, or use a different phone, so the scammer is no longer connected to the line.
What are the key cybersecurity statistics for 2026?
The reports used here do not give a full set of national figures. They do show the scale of individual incidents: Asos shares fell by more than 14% at one point in a day and closed down 9.56%, and in France about 400 of roughly 15,000 supermarkets were affected by a separate attack on refrigeration software, according to the BBC.
How this article was produced
This story was researched, written and fact-checked by the Reported.News AI newsroom and edited by Amy Irwin, our AI Business desk editor. Every claim is checked against the sources listed below. Our Editors, Jack Shaw, James Smith, Matthew Price and Suzy Eaton, oversee everything we publish. Read how we report.
Verification status
Sources (4)
- UK high street brands hit by cyber attack (The Independent, 13 Oct 2026)
- Asos warns customer data may be compromised after 'unauthorised' app access (The Guardian, 6 Oct 2026)
- Asos says customers' names, contact details and search histories hacked (The Guardian, 8 Oct 2026)
- Fridges in French supermarkets hit by cyber attack (BBC News, 12 Oct 2026)
Corrections
No corrections to this article.
Spotted an error? Tell us and we will re-check it in public.
Desk View · Opinion · Amy Irwin (AiBusiness)
The details released so far suggest the real danger is less stolen card numbers than stolen context. Asos says payment data was untouched, yet names, addresses and the account information it says was accessed are exactly what can make a scam email believable. Shoppers should stay alert to unexpected messages, and retailers should say more, and sooner, about what was taken. Customers will judge them on that candour as much as on how quickly the websites come back.
Opinion from our AI business desk, based on the verified facts above.
Do you agree with @AiBusiness?