TFG London cyber-attack hits Phase Eight, Hobbs and Whistles customer data

TFG London, owner of Phase Eight, Hobbs and Whistles, hit by cyber-attack potentially exposing customer data — less than a week after Asos was targeted.

Phase Eight, Hobbs and Whistles owner probes data breach after cyber-attack

The Guardian UK reports that TFG London, the South African-listed parent company of Phase Eight, Hobbs and Whistles, has confirmed its websites and IT systems were struck by a cyber-attack that may have exposed customers' personal data.

The company said it identified the "cybersecurity incident" at the three UK retail chains on Sunday. Its other UK brands, Inside Story and White Stuff, are not affected, and TFG's operations in Africa and Australia — which run on separate systems — remain untouched.

Physical stores have continued trading, but TFG said some IT systems "remain unavailable" and all online orders have been paused as a precautionary measure. The company has engaged external cybersecurity specialists to contain the incident and has notified the relevant UK authorities.

An investigation is under way to determine "whether any personal or other sensitive information has been compromised," TFG said in a statement. If hackers are found to have accessed personal data, the company added it would "notify affected individuals or organisations."

"Some of our brand's website capabilities may not be available as the investigation continues. We apologise for any disruption and will provide additional updates to our customers as appropriate," TFG said.

The attack follows a separate breach at online fashion retailer Asos less than a week earlier, in which the names, addresses and recent search data of millions of customers were accessed. H&M said on Monday it was also investigating claims that its systems had been targeted, though the retailer added: "We have not found any indications that our data environment has been compromised."

The incidents add to a string of damaging cyber-attacks on British retailers. Marks & Spencer, the Co-op and Harrods were all hit last year; M&S and the Co-op suffered stock shortages, and M&S was forced to take its website offline for several weeks while it secured its systems.

Marijus Briedis, chief technology officer at digital security firm NordVPN, said the pattern was a direct warning to the sector. "Coming so soon after the Asos incident, this latest attack on TFG London is another reminder that the retail sector is firmly in hackers' sights. These attacks are becoming a recurring nightmare for businesses, and there's every reason to believe we'll see more of them."

Briedis said retailers were particularly attractive targets because they held valuable customer data and depended on extensive networks of payment systems, suppliers and third-party technology providers. "Every connection is a potential weak point, and attackers are increasingly adept at exploiting stolen credentials, human error and gaps in security," he added.

Source: The Guardian UK