The owner of Phase Eight, Hobbs, and Whistles, TFG London, has confirmed that it has been hit by a cyber attack.

TFG London is the UK subsidiary of South African retail group The Foschini Group, which includes several UK retail brands.

“On Sunday, 11 October, TFG London identified a cybersecurity incident affecting some of our IT systems, specifically impacting our Phase Eight, Hobbs, and Whistles brands. We are actively investigating and working with external cyber security specialists,” a spokesperson told ITPro.

“Stores are open as normal but some of our brand’s website capabilities may not be available as the investigation continues. We apologize for any disruption and will provide additional updates to our customers as appropriate.”

Online orders and returns are believed to be affected.

The firm said it has now put its business continuity plan into place, and has reported the incident to the relevant authorities. It said it was contacting all those customers whose personal data might have been accessed, but that there was no need for customers to change their passwords.

“Importantly, payment processing is carried out by a third-party provider,” it told customers in an email.

“Based on our investigation so far, we have no reason to believe that payment information is at risk. As our investigation continues, we will be working to identify if any sensitive information related to our customers was impacted.”

TFG’s African and Australian operations appear unaffected, as are two other brands it owns, Inside Story and White Stuff.

The hack follows similar attacks last year on M&S, Co-op, Harrods and, most recently, ASOS, which last week warned that an unauthorized party had gained access to some personal data, including names and contact details by impersonating a trusted contact to obtain login credentials.

“It may be a different target but it’s the same hack; impersonate a trusted individual such as an employee, a manager, or a contractor and use that to change passwords and privileges to access systems, and potentially steal millions of customer records and personal information,” said Clive Summerfield, CEO at FARx.

“One phone call is all it took to pull down M&S, Co-op, and Harrods. This resulted in systems going offline, supply chains in chaos, millions of customer records stolen or compromised, and commercial losses in the hundreds of millions.”

It’s not known exactly how the attackers gained access, but – as with the ASOS attack – it seems likely that it was through a third-party supplier, perhaps a Managed Service Provider (MSP) or data hosting provider. So far, no cybercrime group has claimed the attack.

“Organizations need to be shoring up their defenses before attackers find a way in, rather than scrambling to contain the damage afterwards,” warned Susannah Streeter, chief investment strategist at Wealth Club.

“Retailers are particularly attractive targets, sitting on valuable customer data and relying on interconnected systems to keep everything from online orders to supply chains moving. The consequences of a breach can stretch far beyond stolen information, hitting sales, disrupting operations, and eroding customer trust.”