In October 2026, TFG London, the company behind fashion brands Hobbs, Whistles and Phase Eight, confirmed a cyber attack on the IT systems that support its brands.
If a well-known retail group can be disrupted, smaller businesses with fewer resources are just as exposed. Here’s what happened, and what UK SMEs can learn from it.
What Happened at TFG London?
TFG London is the UK arm of The Foschini Group (TFG), a large retail group listed in South Africa.
- 11 October 2026: TFG London identified a cyber security incident affecting the IT systems behind its brands.
- 13 October 2026: TFG disclosed the incident publicly in a stock exchange announcement.
- Brands affected: Hobbs, Whistles and Phase Eight. White Stuff, Inside Story and TFG’s businesses in Africa and Australia were not affected.
- Impact: Several systems remained unavailable, but stores stayed open and kept trading.
- Data: TFG is still investigating whether any personal or sensitive information was compromised, and says it will notify anyone affected.
At the time of writing, TFG hasn’t said how the attack happened or who was behind it.
Why This Matters for Small Businesses
It’s easy to think cyber attacks only happen to big brands. In reality, 43% of UK businesses identified a cyber breach or attack in the last 12 months, according to the government’s Cyber Security Breaches Survey 2025/26.
Large retailers have IT teams, security specialists and budgets to recover. Most SMEs don’t. A few days without key systems can mean:
- Lost sales and missed orders
- Staff unable to work
- Damaged customer trust
- Costly recovery and possible data protection issues
The TFG incident also shows that disruption doesn’t always mean a full shutdown. Stores stayed open, but key systems behind the business were down. For a smaller company, losing just one critical system can be enough to stop trading.
6 Lessons for UK SMEs
1. Have a plan to keep trading
TFG’s stores kept trading while systems were down. Ask yourself: if your main systems went offline tomorrow, how would you take orders, pay staff and serve customers? Write it down in a simple business continuity plan.
2. Back up everything, and test it
Backups are your way back after an attack. Keep copies off-site, separate from your main network, and test that you can restore them. Our backup and disaster recovery service handles this for you.
3. Keep systems patched
Many attacks exploit known flaws. Microsoft’s October 2026 update alone fixed over 1,400 vulnerabilities. Automatic patching closes those gaps before attackers can use them.
4. Protect accounts with strong security
Use multi-factor authentication on every account, and limit admin access to the people who really need it. Stolen logins are one of the most common ways in.
5. Know who to call
Reports say TFG brought in external cyber security specialists to investigate. Have your IT provider’s emergency number ready, and know your reporting duties. Serious personal data breaches must be reported to the ICO within 72 hours.
6. Train your team
Your staff are your first line of defence. Phishing emails and fake login pages are still among the most common ways attackers get in. Short, regular training helps your team spot suspicious emails, links and requests before they cause damage. After a high-profile attack, customers and staff are also more likely to receive scam emails pretending to be from the affected company, so it’s a good time for a refresher.
5 Signs Your Business Isn’t Ready for a Cyber Attack
Ask yourself these quick questions. If you answer “no” to any of them, it’s time to act.
- Backups: Do you know when your backups were last tested?
- Updates: Are all your laptops, servers and software updated automatically?
- Logins: Is multi-factor authentication switched on for every user?
- Plan: Does your team know what to do if systems go down tomorrow?
- Support: Do you have an IT partner you can call at any time?
Attacks rarely come with warning. The businesses that recover fastest are the ones that prepared before anything went wrong.
Is Your Business Prepared?
Cyber Essentials is a government-backed scheme that covers the basic controls that stop most common attacks. It’s a practical first step for any UK SME.
How Sprint Integration Can Help
We help businesses across London, Essex and the South East stay protected and recover fast if the worst happens. Here’s how we help with the problems an attack like this can cause:
Systems go down and the business stops. We build a business continuity plan with you, so your team knows how to keep working, serving customers and taking orders if key systems go offline.
Data is lost, encrypted or deleted. Our backup and disaster recovery service keeps secure, tested copies of your data off-site, so we can restore your files and systems quickly.
Attackers get in through unpatched software. We manage updates across your laptops, servers and Microsoft 365, closing security gaps before they can be exploited.
Threats go unnoticed until it’s too late. We monitor your network and devices around the clock with endpoint protection, so suspicious activity is spotted and stopped early.
Stolen passwords give attackers easy access. We set up multi-factor authentication, strong access controls and secure firewalls to keep unauthorised users out.
Staff fall for phishing emails. We help your team recognise scams and fake login pages, and add email filtering to block many threats before they reach the inbox.
You don’t know where your weak spots are. We guide you through Cyber Essentials and Cyber Essentials Plus certification, giving you a clear security baseline and proof for customers and contracts.
There’s no one to call when something goes wrong. Our UK-based helpdesk is on hand to respond fast, contain the problem and get you back up and running.
Not sure how your business would cope with an attack? Book a free IT Health Check and we’ll review your setup.
FAQs
What happened to Hobbs, Whistles and Phase Eight?
Their owner, TFG London, confirmed a cyber security incident in October 2026 that took several IT systems offline. Stores stayed open.
Was customer data stolen?
TFG hasn’t confirmed this yet. It’s investigating and says it will notify anyone affected.
Could a cyber attack like this happen to a small business?
Yes. 43% of UK businesses identified a breach or attack in the last year, and smaller firms often have fewer defences.
What’s the first step to protecting my business?
Start with backups, multi-factor authentication and patching. Cyber Essentials is a good framework to follow.
