What TFG London has confirmed so far
TFG London, the UK arm of South African retailer The Foschini Group, detected a cyberattack on Sunday, October 11, and issued a public statement two days later. The attack hit several IT systems at Phase Eight, Hobbs, and Whistles. Two other TFG London brands, Inside Story and White Stuff, were not affected, and the group's separate operations in Africa and Australia run on different infrastructure entirely. Stores at the affected brands remained open and trading throughout, though the company has been upfront that a number of back-end systems are still unavailable while it works through the incident.
TFG London activated its incident response and business continuity plans, brought in outside cybersecurity specialists to help contain the attack, and reported it to the relevant UK authorities. It says it is still establishing whether any personal or other sensitive customer data has been compromised and will notify affected customers if that turns out to be the case. Payment processing runs through a third-party provider, and the company says it has no reason to believe card data is at risk. Customers do not need to change their passwords. Online order and returns functions are believed to be degraded in the meantime.
A second breach in the same week
TFG London lands in the middle of a cluster of incidents, not at the start of one. Days before its disclosure, fashion retailer ASOS was hit by its own attack, one that customers first learned about when hackers sent push notifications directly to app users rather than through any official channel from the retailer itself. Separately, H&M Group confirmed it is investigating claims made by the ShinyHunters cybercriminal group that it had breached the retailer's systems. A spokesperson for H&M said the company's own review has so far found no indications that its data environment has been compromised; the investigation remains active and the company has stopped short of a clean bill of health.
Taken together, that is three major UK or UK-facing fashion retailers dealing with security incidents inside a single week, on top of a 2025 run that already hit Marks and Spencer, Co-op, and Harrods. No cybercrime group has claimed responsibility for the TFG London attack, and the company has disclosed little about how the attackers got in. That silence is itself informative for anyone trying to assess their own exposure: it suggests the company either does not yet know which control failed, or is still working through a forensic process before it is ready to say so publicly, and either answer should worry a peer retailer running similar infrastructure and similar vendor relationships.
The same playbook, attack after attack
What makes this run of incidents more than bad luck is the pattern security researchers keep flagging. Clive Summerfield, CEO at FARx, has described the method behind the 2025 wave bluntly: attackers impersonate a trusted individual, typically by phone, to get a help desk agent to reset a password or elevate account privileges. He has noted that one phone call was enough to take down Marks and Spencer, Co-op, and Harrods in succession. That is not a sophisticated zero-day. It is a conversation that a stressed, under-trained, or overly accommodating support agent gets wrong once.
Susannah Streeter, chief investment strategist at Wealth Club, framed the broader exposure this way: organizations need to strengthen their defenses before attackers gain entry, because retailers are attractive targets precisely because of the volume of customer data they hold and how interconnected their systems have become. Interconnection cuts both ways. It is what makes omnichannel retail work, and it is exactly what turns one compromised help desk credential into an outage across stock systems, online ordering, and returns processing all at once.
Why retailers keep losing this fight
Our read is that most retailers responded to the 2025 incidents by hardening the systems that were easiest to harden: endpoint detection, network segmentation, patching cadence. Those are real improvements, but they do not touch the actual failure mode, which sits in a process, not a product. ITPro's reporting on the TFG incident also raises the possibility, consistent with how ASOS was reportedly compromised, that a third-party supplier such as a managed service provider or hosting partner was the initial entry point rather than TFG's own staff. If that holds up, it extends the exposure beyond any single company's internal training program.
That is the uncomfortable part for boards that treated 2025 as a closed chapter. A help desk's authority to reset credentials, and a vendor's access into a retailer's environment, are both decisions made months or years before an attacker ever calls. When three household names fall to the same social engineering script within a year, and a fourth follows the same shape in October 2026, the honest conclusion is that the lesson was absorbed as a news story rather than as a change to who can authorize what, under which verification.
What this means for your incident response budget
The practical fix is not glamorous, which may be exactly why it keeps getting deprioritized. Require callback verification through a separate, pre-registered channel before any password reset or privilege change tied to a high-value account. Remove the help desk's unilateral authority to grant elevated access, and route those requests through a second approver who is not reachable by the same phone call that started the request. Audit third-party and vendor access on a fixed schedule rather than only after an incident, since that is now the leading theory behind more than one of this year's breaches.
For CTOs setting next year's security roadmap, the TFG, ASOS, and H&M incidents are the strongest argument available for funding this specific control class now rather than waiting for a board mandate after your own breach. Tabletop exercises should simulate a convincing phone call, not just a phishing email, because that is the attack that has actually worked, repeatedly, against companies with budgets far larger than most. The pattern is no longer a warning. It is a track record.
