Hobbs, Whistles and Phase Eight Went Down Together. White Stuff, in the Same Group, Kept Trading.

01 What TFG London has confirmed, and what it has not

Ten days in, the public record is short. Everything below comes from TFG London’s own statements or the brands’ websites as reported by named outlets. Where reports disagree, we have left the figure out.

Three things are still unknown. TFG has not described the attack, so nobody outside the company can say whether this is ransomware, data theft or both. It has not said whether customer data left the building. And we could not confirm whether Whistles has restarted online orders since 16 October. When we checked its website on 21 October there was no notice either way.

On the data question, the clock is already running. Under Article 33 of the UK GDPR, a company reports a notifiable personal data breach to the ICO within 72 hours of becoming aware of it [ UK GDPR Art. 33 ] . TFG says it told “relevant UK authorities” without naming them. The ICO has not commented publicly.

02 If you shop at Hobbs, Whistles or Phase Eight

Your card details are probably the least of it. TFG says it has no reason to think payment information is at risk. The bigger risk this month is a scammer who knows you have an order stuck in the system. Breaches like this produce a wave of messages about refunds, delayed parcels and account checks, and they keep coming long after the headlines fade.

1. Do not re-order. TFG London says orders placed since 11 October may be delayed and do not need resubmitting. A second order risks a duplicate charge once systems return [ Local London ] .
2. Distrust any message about this incident. A text offering a refund for your delayed Hobbs order, or a call from “Phase Eight security”, gets the same treatment: hang up or close it, then go to the brand’s website yourself.
3. Change reused passwords. If the password on your fashion account also opens your email or your bank, change it on those first. A passkey, where offered, removes the problem.
4. Watch the account and the bank statement. Look for logins, changed delivery addresses or orders you did not place. If you lose money, tell your bank and report it to Report Fraud.

The NCSC’s guidance for individuals after a data breach covers each of these steps in more detail [ NCSC ] . Nothing in it requires TFG to confirm a breach first, and you can do all of it in an evening.

03 Why White Stuff kept trading

TFG bought White Stuff in October 2024, and Drapers reported that the brand was not affected because it runs on different systems [ Drapers, 14 Oct 2026 ] . TFG has not described the IT behind Hobbs, Whistles and Phase Eight. All three lost systems in the same incident, though, which tells you they share at least part of it.

We don't know whether TFG kept White Stuff apart on purpose. Acquired brands often keep their own stack for a year or two because migration is slow and expensive. Either way, it shows a trade-off most mid-size retail groups make without writing it down. Shared IT is cheaper to run, and one set of stolen admin credentials then reaches every brand at once. Groups that pay for separate tenancies, identity and backups spend more, and they lose less when one bad Sunday comes.

In our internal tests the pattern repeats. A retailer runs several fascias or regions, and they share an Active Directory forest, a privileged admin group, a backup console or an RMM tool. Once we hold any one of those, the brand boundary no longer exists. The org chart says four businesses. The network says one.

04 Four UK fashion retailers in two weeks

TFG London was the second UK fashion retailer to disclose an attack in a week. ASOS went first, on 6 October, when an attacker used a social-engineered employee account to send an extortion message through its app. We covered that one in the ASOS push notification hack. Drapers reported that brands sold through ASOS saw slower sales in the days after, with one executive describing a “substantial drop in order volumes” [ Drapers ] .

H&M is the third name, and the weakest case. A group connected to ShinyHunters claims to have breached it and posted a small data sample. H&M says it has “not found any indications that our data environment has been compromised” [ Bank Info Security ] . Treat that one as a claim until either side shows more. No evidence links any of the three incidents.

The comparison everyone in UK retail reaches for is spring 2025. M&S stopped taking online clothing and home orders on 25 April and restarted them 46 days later, after attackers deceived staff at a third-party contractor. It forecast a hit of about £300m to operating profit before insurance [ Reuters / ESM, Jun 2025 ] . At the Co-op, the attackers took the names, addresses and contact details of all 6.5 million members [ The Telegraph, Jul 2025 ] .

The timing is the other reason to act now. Ade Clewlow of NCC Group told Drapers that retailers become an attractive target “as we approach Black Friday and the busy festive period” [ Drapers ] . Black Friday is five weeks away. A retailer whose online orders stop in late November loses its best weeks of the year.

05 Five tests for a retailer or its MSP before peak

These assume you run between one and a handful of brands, a web shop on a mix of your own and third-party platforms, and IT that is partly or wholly run by an MSP. Each test has a yes or no answer. A “not sure” counts as no.

1. Call your own helpdesk. Have someone outside IT ring the service desk, in-house or the MSP’s, as a stressed store manager locked out before opening. Does the desk reset the password or the MFA without a check the caller cannot fake? M&S lost 46 days of online clothing sales after attackers talked their way past a contractor. Test it in a scoped social engineering exercise, with written approval.
2. Map what one admin account reaches. Pick the most privileged account in each brand. List every system it can log into: other brands’ file shares, the e-commerce admin, the warehouse system, the backup console, the RMM tool. If the list crosses brand lines, you have the shared failure TFG’s three brands appear to have had.
3. Run a week without core systems on paper. TFG’s stores kept trading while online orders stalled. Could yours? Walk through how you would take orders, tell customers about delays and handle returns with the ERP and order management offline for seven days. Write down who decides to pause the website, and who drafts the customer notice.
4. Check that backups survive a domain admin. Ask your MSP to show, live, that an attacker holding domain admin cannot delete or encrypt the backups. Immutable or offline copies, separate credentials, and a restore you have actually tested this year.
5. Lock down who can speak in your name. After a breach, your email platform, SMS gateway and app push become the channel you need most and the one an attacker most wants. ASOS showed what happens when an attacker reaches them first. Put them behind single sign-on with phishing-resistant MFA, and make a send to every customer need two people.

MSPs carry a particular share of this. A service desk that resets credentials for a dozen retail clients is one convincing phone call away from all of them. If you are that MSP, the helpdesk test above is the one your clients will ask about first after reading this news.

TFG London will publish more as its investigation goes on, and some of the detail here may change. The question for your own business will not. If one admin account fell on Sunday night, how many of your brands would be trading on Monday?