The owner of Phase Eight, Hobbs and Whistles has confirmed that customer personal data was accessed during a cyber attack earlier this month.
TFG London, the UK arm of South African retail group The Foschini Group, contacted customers on 28 October after its investigation found that some personal information had been accessed.
The company identified the cybersecurity incident on 11 October, affecting IT systems used by its three fashion brands.
In an email to customers, TFG London chief executive Justin Hampshire said the business had acted immediately to secure its systems, enlisted independent cybersecurity specialists and notified the relevant authorities.
He added that the investigation was continuing to establish exactly what information had been accessed, and that contacting customers did not necessarily mean their individual information had been compromised.
The data potentially affected includes contact and delivery details, order information and, in some cases, limited payment information, such as the last four digits of a payment card.
Related Story
TFG London said the breach did not involve usable payment card details and that its investigation had found no evidence that account login information or passwords had been accessed.
Payment processing is handled by a third-party provider, and the company said customers did not need to take immediate action.
However, it advised shoppers to remain alert to unexpected emails, phone calls and text messages, warning that compromised information could be used to make fraudulent communications appear more convincing.
The retailer also reminded customers that Phase Eight would never ask for passwords or full payment card details by email, text or telephone.
TFG London initially disclosed the cyber attack in October, saying it had affected certain IT systems across Phase Eight, Hobbs and Whistles. Its stores remained open, although some systems and online services were disrupted.
The group activated its incident response and business continuity plans and brought in external cybersecurity specialists to contain the incident.
Its other UK brands, White Stuff and Inside Story, were unaffected, as were its operations in Africa and Australia, which run on separate systems.
Click here to sign up to Retail Gazette‘s free daily email newsletter
