South Africa's The Foschini Group found an attack on 11 October that disrupted IT systems at its TFG London fashion brands, and disclosed it on 13 October1. Stores stayed open, and no attacker has been named. The discovery came five days after ASOS customers received a rogue push notification through the retailer's app.
22OCT
Foschini Group attack hits TFG London
1 min read
16:31UTC
South Africa's The Foschini Group found an attack on 11 October that disrupted IT systems at its British fashion arm, TFG London. Stores stayed open.
TechnologyDeveloping
Key takeaway
The Foschini Group's British fashion brands lost IT systems to an attack found on 11 October.
Deep Analysis
In plain English
The Foschini Group is a big South African retailer that also owns British fashion brands such as Hobbs, Whistles and Phase Eight, run as TFG London. Hackers disrupted those brands' computer systems on 11 October. The shops stayed open, and the company says card payments go through an outside provider.
Root Causes
TFG London runs as a distinct British arm of a South African parent, and only some of its brands were affected, which suggests segmented IT limited the spread. Payments run through an external provider, which keeps card data outside the affected systems.
What could happen next?
- Risk
If personal data was taken, TFG London customers in the UK may face phishing that uses their purchase history.
Sources:The Record
First Reported In
Update #15 · Fridge hack spoils food in seven countries
The Record· 22 Oct 2026
Read original →Causes and effects
This Event
Foschini Group attack hits TFG London
A South African retail group's British fashion brands were disrupted days after ASOS customers received a rogue app alert.
Different Perspectives
Hospital Sírio-Libanês
Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.
The Foschini Group
The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.
FirstVDS
FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.
ESET
ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.
JPCERT/CC
JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.
Cyber Security Agency of Singapore
The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.
Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.