South African fashion retailer The Foschini Group (TFG) said a cybersecurity incident at its British business has knocked several IT systems offline at the Phase Eight, Hobbs and Whistles brands, Reuters reported Tuesday. The company is still investigating whether personal data was taken. That makes TFG London the latest UK retailer to disclose an intrusion within days of ASOS, keeping pressure on the sector’s defenses.

What Happened

In an announcement on the Johannesburg Stock Exchange’s news service, known as SENS, issued at 7:05 a.m. South African time Tuesday, TFG said its UK business identified the incident Oct. 11. It affected IT systems serving Phase Eight, Hobbs and Whistles. Two other TFG London businesses, Inside Story and White Stuff, were not affected.

TFG said it activated its incident response and business continuity plans, brought in outside cybersecurity specialists to contain the incident and reported it to the relevant UK authorities. TFG London’s stores remain open and trading, but several IT systems are still unavailable. TFG Africa and TFG Australia run on separate systems and were not affected, the company said. The announcement did not estimate a financial impact.

RelatedCybersecurity Incident at BAE Systems Halts Notices From U.S. Bankruptcy Courts

The investigation includes whether any personal or other sensitive information was compromised. If so, TFG London will notify affected people and organizations, the company said.

The Register reported that TFG told customers in an email that payments are processed by a third party and that, based on its investigation so far, it has no reason to believe payment information is at risk. Citing an email seen by The Telegraph, The Register said customers were warned that orders placed on or after Sunday could be delayed. TFG has not said how the attackers got in, whether ransomware (malicious software that locks files until a ransom is paid) was involved or when systems will be restored, according to The Register, which said the UK Information Commissioner’s Office did not respond to its request to confirm a notification.

Why It Matters

For retail boards, the incident shows the value of separating systems across business units. TFG’s statement that its African and Australian operations run on separate infrastructure is why an intrusion in London has not spread to a group that trades on three continents. Directors at companies with shared IT across brands or regions may want to know how far a single compromise could travel.

The unresolved data question carries the larger legal and reputational risk. TFG has committed to notify affected people if a compromise is established, but until the investigation concludes, customers of three brands do not know whether their details were exposed, and the company cannot yet size its notification duties.

The timing adds to sector-wide concern. Last week, ASOS said an attacker posed as a trusted contact to obtain an employee’s login and used it to reach third-party platforms holding customer names and contact details. The Register reported that no evidence links the TFG and ASOS incidents. Still, two disclosures in a week are likely to prompt retailers to look again at how staff verify callers and how outside platforms are accessed.

What to Watch

TFG said its board will keep assessing the situation and will issue another SENS announcement if there are material developments. Key questions are whether personal data was taken, when the affected brands’ systems and online ordering return to normal, whether any criminal group claims responsibility, and whether the Information Commissioner’s Office confirms it is involved.