TFG London Cyberattack: UK Fashion Brands Hit by Data Breach

• The Foschini Group Limited (TFG) experienced a cybersecurity breach targeting its UK operations on October 11, 2026.
• The TFG London cyberattack affected three core high street fashion brands and was publicly disclosed on October 13, 2026.
• TFG engaged external cyber forensic experts and reported the incident to UK authorities, while physical stores remain operational.
• The breach is isolated to the UK, with TFG Africa and TFG Australia systems unaffected.
• An investigation is ongoing to determine if customer or corporate data was compromised, with TFG committed to notifying affected parties if necessary.

TFG has publicly committed to its UK data protection notification obligations, which are crucial under frameworks like GDPR.

South African retail conglomerate The Foschini Group Limited (TFG) has confirmed a significant cybersecurity breach impacting its United Kingdom operations. This TFG London cyberattack UK fashion brands has targeted several prominent high street fashion labels under the group's umbrella, raising concerns across the retail sector. The compromise to TFG London's IT system was first identified on Sunday, October 11, 2026, leading to a voluntary public disclosure via the Sens platform on October 13, 2026, just two days after discovery.

The security incident specifically affected three core retail brands within TFG's UK division, though their names were not disclosed in the initial announcement. Upon discovering the intrusion, the group promptly activated its internal emergency protocols, signaling a swift and decisive response to the unfolding situation. External cyber forensic experts were immediately engaged to assist with the investigation and containment efforts, underscoring the severity and specialized nature of the IT system compromise.

In response to the TFG retail cybersecurity incident, the company swiftly implemented its established incident response and business continuity plans. This proactive approach included bringing in specialized external cybersecurity professionals to manage and contain the breach, a critical step in mitigating potential damage and restoring system integrity. Furthermore, TFG London has fulfilled its initial regulatory duties by reporting the incident to the relevant authorities within the United Kingdom, demonstrating adherence to local protocols.

Despite the ongoing IT system outages resulting from the TFG London IT system compromise, the physical retail stores operated by TFG London have managed to remain open and continue trading without interruption, minimizing direct impact on consumer access. The company has also clarified that the breach is strictly confined to its British operations. Importantly, TFG confirmed that its infrastructure in its home market of South Africa, as well as its Australian operations, are entirely separate and unaffected, with TFG Africa and TFG Australia running on distinct systems, thereby preventing a wider international incident.

A primary focus of the ongoing investigation by cyber forensic experts TFG has engaged is to determine the precise extent to which customer or corporate data may have been compromised. Forensic teams are diligently working to establish whether any personal or other sensitive information, which could include customer details or proprietary business data, has been accessed or exfiltrated as a result of the Foschini Group UK data breach. This critical assessment will dictate the subsequent actions required by the company under stringent data protection regulations.

TFG has publicly committed to its UK data protection notification obligations, which are crucial under frameworks like GDPR. Should the investigation confirm that personal or sensitive information has indeed been compromised, TFG London has stated it will promptly notify all affected individuals or organizations, as appropriate, in compliance with regulatory requirements. This proactive stance is essential for maintaining trust and adhering to legal mandates. The board of directors for TFG is actively monitoring the situation and has pledged to issue further formal updates through Sens if any material operational or financial developments arise, ensuring transparency throughout the process and keeping stakeholders informed.

Compliance officers and legal counsel for retail companies with UK operations should review their cybersecurity incident response plans and data breach notification protocols, particularly concerning GDPR and UK data protection laws, given TFG London's experience and potential notification obligations to affected individuals and authorities.

Source: Original reporting via the Sens platform