The Foschini Group's stores in South Africa traded as normal this week. In London it was a different story. On Sunday, TFG's UK business found a cybersecurity incident in its IT systems, hitting three of its fashion brands: Phase Eight, Hobbs and Whistles. When TFG told the JSE on Tuesday, several of those systems were still down.
The shops themselves are open. The trouble is behind the counter. "We are working hard to get all our systems back up and running as quickly and safely as we can," TFG London wrote to customers. It has told them that orders placed on or after Sunday may be delayed, that it has no reason to believe payment information is at risk, and that there is no need to change account logins for now. Outside specialists have been brought in and UK authorities informed, and the company is still working out whether any personal information was taken. Anyone affected, it says, will be told directly.
Why the damage stopped at London
TFG bought its London business in 2015, and the group keeps its other regions on systems of their own. TFG Africa and TFG Australia were not affected, the company says. Even inside London the incident was selective: two other brands, Inside Story and White Stuff, came through untouched.
A business that sells online
That leaves the online shop, which matters far more to London than to the rest of TFG. TFG London made 41.6% of its sales online in the 21 weeks to 22 August, against 15.9% for the group as a whole. Delayed orders land squarely on that channel.
British retailers know how long this can drag on. Marks & Spencer had to stop taking online clothing orders for seven weeks after its April 2025 attack, and its latest results put the direct cost at £131.3 million for the year. The Co-op had the personal details of all 6.5 million of its members stolen. Asos was hit just days before TFG, with customers getting threatening messages through its own app, and H&M is looking into claims it was targeted too, though there is no evidence linking the three.
TFG has not said what caused the incident, who might be behind it, or when its systems will be back.
