TFG London says Phase Eight customer data was accessed

The hardest part of a retail cyber incident often comes after the systems are back. TFG London, which owns Phase Eight, Hobbs and Whistles, has told customers that its investigation "has shown that some personal data has been accessed", and that its stores and website are fully operational.

What the company said

In a customer FAQ on the Phase Eight website, the business said: "On Sunday 11th October, we identified a cybersecurity incident affecting some of our IT systems." The page describes the incident as involving "TFG London, the parent company of Hobbs, Whistles, Phase Eight, Inside Story, and White Stuff."

The data that may be involved is the kind that makes a customer relationship work. The FAQ lists "Contact or delivery details, including your name, email address, phone number and postal address", "Order information, including items ordered" and "Limited payment information, such as the last four digits of a payment card." The company added that the card information "cannot be used on its own to make a payment." It also said its investigation "has not identified any evidence that account login information or passwords were accessed."

TFG London said it was "contacting all of our customers as a precaution", while stressing that a notice "does not mean that your information was affected" and that its work to establish exactly what was taken "is continuing." It said the attackers appeared "to have been financially motivated and to have targeted our business", but it also said it "cannot rule out that information may be misused or published".

On trading, the FAQ said "all our stores and website are fully operational" and that "payment processing is carried out by a third-party provider".

Why it matters beyond IT

A last-four-digits card fragment is not a payment risk on its own. Combined with a name, address and a list of recent purchases, though, the company said such details could potentially be used to make scam messages more convincing. That is why the brands are now leaning on customer education: Hobbs states that it "will never ask you to provide your password or full payment card details by email, text or phone."

For a premium womenswear group whose customers are often loyal repeat shoppers, the commercial question is less about this week's sales and more about whether those customers keep trusting emails from the brand. Contacting everyone is the cautious choice, but it also means a larger volume of worried customers for service teams, and a period in which genuine marketing emails may be met with suspicion.

What is still unknown

The FAQ does not say how many customers were affected, which brands' records were involved, or when the data access was confirmed. The company itself describes the investigation as ongoing, so the scope could still change. What would change the picture is evidence of the data being published or used, which the company has said it cannot rule out. Until then, the clearest lesson for other retailers is practical: know in advance what customer data you hold, how quickly you could tell those customers, and what you would ask them to watch for.