TFG London's 163-word notice names three brands and no cause; its payment-data belief is not in it

A 163-word notice, and a payment line that is not in it

Position at 11:42 BST on Tuesday 13 October 2026. This story is moving. Everything below was read between 11:17 and 11:42 BST today and is stamped where it appears. TFG London's notice says the Board will publish a further announcement "if required". At 11:41 BST Sharenet's SENS list for TFG showed nothing after the 07:05 notice, and the BBC, The Register and the three brand home pages were unchanged on a second read. Re-read the sources before relying on any of it.

The stock exchange notice from TFG London's parent runs to 163 words in ten sentences (derived count). It gives one date, Sunday 11 October, three brand names and the phrase "certain of its IT systems". It promises that affected individuals or organisations will be told if personal or sensitive information turns out to have been compromised. It gives no cause, no number of customers, no data finding, no restoration time and no statement about payment information.

That last gap matters, because the line most customers will have read is about payment cards. The BBC and The Register relay that TFG London does not believe payment information was affected, and both take it from a customer email. A Press Association copy gives the same words as the company's, without saying where they came from. The notice, read in full on Sharenet's copy of the Johannesburg exchange's SENS service, does not contain them. The belief about payment data is therefore on the record only at one remove, while the one filed document is silent. I could not read the email.

Counting from Sunday, the UK GDPR's 72 hour outer limit for telling the regulator, where feasible, falls on Wednesday 14 October (derived: 72 hours after the start and after the end of Sunday are 00:00 on Wednesday and 00:00 on Thursday). That limit runs from awareness of a personal data breach, and TFG London has not said it has found one. On the same assumption, about 12 to 36 hours of it remain at 11:42 BST (derived).

Here is what the notice and the reports do not establish.

• The cause. The Register reports that the company has not said how attackers got in or whether ransomware was involved.
• That personal data was taken. The notice says the investigation is "establishing whether" personal or other sensitive information has been compromised. That is not a finding either way.
• That payment information is safe. It is a belief, relayed from an email, and The Register adds that it rests on the investigation "so far".
• That the incident is linked to ASOS or H&M. The Register says no evidence currently links them.
• That the ShinyHunters claim against H&M is true or false. What is on the record is a claim circulating online and H&M's statement that it has found no indications.
• The numbers a customer would want. How many people, which systems, and when they return are not stated.

What TFG London has stated, by whom, and what is not stated, as at 11:42 BST on 13 October 2026. Sources: the SENS notice, TFG London's press statement as quoted by PA copies and the BBC, a customer email as relayed by the BBC and The Register.

Question	Stated, and by whom	Not stated
What happened?	TFG London "identified a cybersecurity incident on 11 October 2026 affecting certain of its IT systems" (SENS). Its press statement says "some of our IT systems".	The type of incident, the route in, whether ransomware was involved, and whether it is contained. The notice says specialists were engaged "to contain the incident".
When?	Sunday 11 October (SENS and press statement). The notice was released at 07:05 South African time on 13 October, which is 06:05 BST (derived conversion).	The hour of identification. Whether anything happened before Sunday.
Which brands and units?	Phase Eight, Hobbs and Whistles are affected. Inside Story and White Stuff are not. TFG Africa and TFG Australia run on separate systems and are not affected (SENS).	Which legal entities. The three brands' privacy policies name three separate companies as controller.
Which systems, and what works?	"Several of its IT systems remain unavailable" and stores are "open and trading" (SENS). "Some of our brand's website capabilities may not be available" (press statement). Orders placed on or after Sunday could be delayed (a customer email seen by The Telegraph, as relayed by The Register).	Which systems. Whether tills, stock or returns processes have changed beyond "stores are open as normal".
Personal data?	The investigation is "establishing whether any personal or other sensitive information has been compromised"; affected people will be notified "as appropriate" (SENS). A customer email says those affected will be told directly (BBC, citing PA).	Any finding, which data, how many people.
Payment information?	A customer email says TFG London does not believe it was affected (BBC). The Register adds that a third-party provider handles payment processing and that TFG London has "no reason to believe" it is at risk. Not in the SENS.	The evidence behind it. Whether the email is the whole statement.
Account logins?	"We do not believe it is necessary to change your account login information at this time" (customer email, via the BBC).	What would change that view.
Regulators?	The incident "has been reported to the relevant UK authorities" (SENS).	Which authorities. The Register asked the ICO to confirm and reports no response.
Restoration?	Nothing.	Any date. The Register says none has been given.

Four documents about one incident, and they are not the same document

It is easy to read "TFG London said" as one statement. At least four artefacts carry TFG London's words, and each says something the others leave out.

The artefacts read for this briefing, with times in BST. The SENS and the brand pages were read directly; the statement and the email are known through outlets.

Artefact	When	What it carries, and leaves out
SENS notice on the Johannesburg exchange's service, read on Sharenet's copy	Released 07:05 South African time, Tuesday 13 October; 06:05 BST (derived conversion)	163 words. The date, the three brands, stores open, separate systems in Africa and Australia, "reported to the relevant UK authorities", a further SENS "if required". No payment line, and no mention of a customer email.
TFG London's press statement, as quoted in a Brit Brief copy at 07:01 and by the BBC	By 07:01 BST on 13 October	71 words in four sentences (derived count): the date, the three brands, investigation with external specialists, website capabilities, an apology, updates "as appropriate". No data line and no payment line in the quoted text.
A customer email, as relayed by the BBC (citing PA) and The Register (citing The Telegraph)	Not stated. The reports run from 07:42 to 10:45 BST.	The payment belief, the personal-information and direct-notice wording, the login line, delayed orders. I did not read it: The Telegraph blocked automated reads and no outlet read here prints the email in full.
The three brand websites, home pages read at 11:18 and 11:19 BST and again at 11:41, and Phase Eight's help pages	11:18 to 11:19 and 11:41 BST on 13 October	No incident notice found on any of them, on a text search for incident, cyber and disruption wording. A notice may sit elsewhere.

Identification to disclosure (derived). TFG London gives the date and not the hour. If the identification came at the very end of Sunday, the SENS notice followed 30 hours 05 minutes later; if at the very start, 54 hours 05 minutes later. The BBC report, published at 10:34 BST, came 34 hours 34 minutes to 58 hours 34 minutes after the identification window opened and closed (the same arithmetic), and The Register at 10:45 BST. None of those intervals is the UK GDPR clock, which runs from awareness of a breach and not from identification of an incident. An earlier briefing on a police force that identified an incident on the 14th and disclosed it on the 25th covers how the regulator's clock and the public one differ.

Who is speaking. The notice is an announcement by a company listed in Johannesburg, written for shareholders. The press statement and the customer email are written for customers. A listed parent has an interest in not alarming either audience, which is a reason to read each text for what it commits the company to, not a reason to doubt it.

Five phrases that sound like findings

Each phrase below reads like a result. Each is a label, a belief or an absence, and each carries a limit inside it. A comforting label is not a control, and a belief is not a finding.

Phrases from TFG London and H&M, what kind of statement each is, and what it does not establish. Sources: the SENS notice, the press statement, the customer email as relayed, and H&M's statement as reported.

Phrase	What it is	What it does not establish
"certain of its IT systems" (SENS); "some of our IT systems" (statement)	A category with no members named.	Which systems, or whether customer records sit on them. The same notice says "several" are unavailable, so "some" and "several" describe the same estate.
"some of our brand's website capabilities may not be available" (statement)	A description of the shop window.	Why. The Register reports several systems offline and orders placed on or after Sunday facing delay, from The Telegraph's copy of the email. The wording is softer than the operational fact.
"no reason to believe that payment information is at risk" (PA copy); "did not believe" it was affected (BBC)	A belief at one moment. The Register gives its basis: a third-party provider handles payment processing, and the view rests on the investigation "so far".	That no card detail sits in any order record, or that other personal data is safe. Where cards are processed is not what the retailer's own systems hold about customers.
"We do not believe it is necessary to change your account login information at this time" (customer email, via the BBC)	A belief with a time limit written into it.	Whether any credential, in any form, could be reached, or what would change the view.
"we have not found any indications that our data environment has been compromised" (H&M, to the BBC)	An absence of findings, at one time, from a company still investigating. The Times's version, as quoted by Yahoo Finance UK, says "so far we have no indication".	That nothing was taken. "Data environment" is not defined, what was checked is not stated, and the same Yahoo report has H&M describing the claims as involving "a limited scope of H&M Group data".

The NCSC's guidance on communications in a cyber incident, published 16 October 2024, anticipates this. It says to avoid saying anything that may have to be retracted later, and that "stating that there is no known impact on staff or personal data can be problematic later down the line if this understanding changes in later investigations". That is guidance to every organisation, and it is not a finding about TFG London. A belief can still be the honest statement on day two.

ASOS shows how fast a first statement of scope can move, though it is a different company with a different cause and it predicts nothing about TFG London. ASOS's RNS of 6 October said basic personal information including name and contact details "may have been accessed" and that it did not believe payment-card information or account passwords were impacted. Its email to customers on Thursday 8 October, as relayed by PA, in the Irish News and LBC, said an unauthorised party reached an employee account by impersonating a trusted contact, accessed names and contact details and "certain non-personal account-related information", and did not access payment card information or account passwords. The BBC reports that hackers had obtained more detailed personal information than ASOS first suggested, and that ASOS issued its update after the BBC told it that cybercriminals had contacted the BBC saying the breach went beyond basic contact details. The earlier ASOS briefing reads the 6 October RNS; the 8 October email is read here only through PA, LBC and Drapers, not from ASOS itself.

H&M: a claim, a denial with a time on it, and a link nobody has shown

What is on the record about H&M is thinner than the headlines. The BBC says it was reported on Monday that H&M was investigating claims of a hack by a group called ShinyHunters, and quotes H&M: "We are aware of information circulating online regarding a potential cyber security incident and are currently investigating the claims." Drapers says The Times first reported it on Monday 12 October. I read only The Times's headline and standfirst, because the article is behind a paywall and I did not bypass it. Drapers and TheIndustry.fashion, both citing The Times, and Yahoo Finance UK, also citing it, carry H&M's statement. H&M Group's newsroom, read at 11:22 BST, has nothing newer than 29 September.

I did not visit any site where the group posts, and I did not read its claim first-hand. Cybernews blocked automated reads and is not used. Everything below about the claim is as relayed.

What is on the record about the H&M claim, as read between 11:17 and 11:42 BST on 13 October 2026. Sources: the BBC, Drapers, TheIndustry.fashion and Yahoo Finance UK (all secondary), and H&M Group's newsroom.

Question	Stated, and by whom	Not stated
Who is the claimant?	A group called ShinyHunters (BBC, Drapers, TheIndustry.fashion). The BBC says it has been linked to attacks including the FBI, Rockstar Games and Ticketmaster.	The claim's own text, first-hand. Which data it says it holds.
What does H&M say?	Aware of information circulating online; investigating; "not found any indications" of compromise (BBC). Via The Times: "so far we have no indication" and a "limited scope of H&M Group data" (Yahoo Finance UK).	What was checked, by whom, or when it will report.
Has a regulator been told?	Drapers: H&M had not contacted the ICO because it had found no indications. The Times, as relayed by TheIndustry.fashion and Yahoo: the ICO had no report at Monday lunchtime.	Anything after Monday. The ICO's news page, read at 11:26 and 11:42 BST, has no item on H&M.
Is it linked to ASOS?	Drapers, citing The Times: unnamed sources thought the same group was behind both. The BBC describes ASOS as hit by "another group". The Register: no evidence currently links the incidents.	Any evidence, or who the sources are.

Treat the claim as what it is. A claim about your data is a hypothesis with a cost to test, made by a party that gains if it is believed. The earlier briefing on ShinyHunters makes that argument from the FBI jobs-portal case, where the official record was 105 words. It cuts both ways. Of the 2,627 ransomware attacks Comparitech counted for July to September, the victim has confirmed 247 (9.4%, derived) and 2,380 rest on claims, as that briefing reports. Unconfirmed does not mean false, and it does not mean true.

Three incidents date from one Sunday, and no link is on the record

The BBC calls this a week of retail incidents. The site's briefings give a way to count them, with a caveat: the metadata has no sector field, so this is a reading of titles, not a query. In the 14 days to 13 October the site has live briefings on three retail incidents: ASOS, the French supermarket refrigeration attack and Ahold Delhaize. One concerns a UK retailer. With this briefing it is four, two of them UK (ASOS and TFG London). H&M is a claim and is not counted.

Days between them (derived). ASOS's customers received the notification at around 10:00 on Tuesday 6 October, in ASOS's own RNS wording. TFG London identified its incident on Sunday 11 October, five calendar days later, which is between 4 days 14 hours and 5 days 14 hours after 10:00 depending on the hour. The BBC's report of TFG London came 7 days and 34 minutes after the ASOS notification, which is the BBC's "only a week after".

Three of the dated incidents begin on the same Sunday: TFG London's identification, Albert Heijn's page putting the start on Sunday afternoon (briefing 306), and the French attack from the night of 11 October (briefing 304).

The retail incidents and the claim of the last two weeks, with the cause each source states. Sources: ASOS's RNS and PA reports, the site's briefings 304 and 306, the SENS notice, the BBC and The Register.

Incident	First dated	Cause stated
ASOS (UK, briefing 245)	About 10:00, Tuesday 6 October (its RNS)	Per ASOS's 8 October email, as relayed: a staff account reached by impersonating a trusted contact.
Supermarket refrigeration, France (briefing 304)	From the night of 11 October	None stated. Danfoss says most affected units were end of life; no source read ties it to published flaws.
Ahold Delhaize, Netherlands and US (briefing 306)	Sunday afternoon, 11 October (Albert Heijn's page)	None stated.
TFG London, UK (this briefing)	Sunday 11 October (SENS)	None stated.
H&M (a claim only)	Reported Monday 12 October	A claim circulating online. H&M: no indications so far.

The Register says no evidence currently links the incidents at TFG London, ASOS and H&M. The French briefing says a Dutch retail incident is not shown to be related to it, and the Dutch briefing reports a group spokesperson seeing no link to France. Neither could have checked TFG London, which was not public until Tuesday morning. A shared Sunday is a reason to ask whether suppliers, platforms or techniques are shared. It is not evidence that they are. The ASOS cause, an impersonated contact leading to staff credentials, is also the only cause stated anywhere in the table, so it cannot be used to fill the blanks beside it.

UK law and guidance, as read: the clock, the controller and the customer

The 72 hours. The ICO's reporting page, read at 11:20 BST today, says: "If a risk is likely, you must notify us, as soon as possible, and where feasible within 72 hours", and, if the risk to people is high, "you must also notify those people without undue delay". The page says it was last updated on 28 May 2025 and that the guidance is under review after the Data (Use and Access) Act. It also says the full picture may not be available within 72 hours and that organisations should "provide whatever relevant information you have" and add the rest later, which matches Article 33(4), allowing information to be provided in phases. Since 30 September 2026 the Article's text says "the Commission", the Information Commission, where the ICO's page still says ICO.

Awareness. The ICO's guide points to the Article 29 Working Party guidelines for when a controller has "become aware". Those say a controller is aware when it has "a reasonable degree of certainty that a security incident has occurred that has led to personal data being compromised", that a short initial investigation is allowed, and that it "should begin as soon as possible". Counting from Sunday is therefore the cautious reading. TFG London may count from a later point, and it has not said which.

What has been said about the regulator. TFG London says the incident "has been reported to the relevant UK authorities". It does not name them. The Register asked the ICO and reports no response. The ICO's news page, read at 11:26 and again at 11:42 BST, has no item on TFG London or H&M; its newest item is dated 9 October. It did publish an ASOS statement on 7 October, the day after the ASOS message, with advice to the public.

Who the controller is. The notice speaks for "TFG London". The brands' own privacy policies name separate controllers: Phase Eight (Fashion & Designs) Limited (policy), Hobbs Limited (policy) and Whistles Limited (policy), each saying it is registered with the ICO. The 72 hour duty falls on the controller, and the public record does not say which companies have notified.

Telling individuals. Article 34(1) requires the controller to tell the data subject "without undue delay" when a breach is "likely to result in a high risk". TFG London's wording, that it "will notify" those affected if the investigation finds compromise, is conditional on a finding that has not been made. Article 34(3) lists exceptions, including data rendered unintelligible by encryption.

What the NCSC says to customers. The NCSC's guidance for individuals, published 28 January 2021, says to find out whether you are affected through the organisation's official website or social media and not through links or contact details in messages. It says suspicious messages "may be sent some time after the breach is made public", and that criminals "may even send messages pretending to be from an organisation that has suffered a recent data breach". Its list of lures includes official-sounding messages about "resetting passwords", "receiving compensation" and "missed deliveries". If a suspicious message quotes a password you have used, change it wherever you still use it. The ICO's ASOS statement gives the same advice and adds multi-factor authentication. Reporting routes are on the NCSC's phishing page.

What the NCSC says to retailers. After the spring 2025 retail incidents, the NCSC's recommendations, by its National Resilience Director and its Chief Technology Officer, asked organisations to deploy 2-step verification comprehensively, to enhance monitoring for unauthorised account misuse, to pay attention to administrator accounts, and to "review helpdesk password reset processes". The NCSC said then that it could not say whether those incidents were linked. That advice is more than seventeen months old and about other incidents. Nothing read says how TFG London was reached, so it is a baseline and not a diagnosis.

If it proves to be ransomware or extortion. TFG London has not said so. The NCSC's ransomware guidance, version 3.0, reviewed 9 September 2021, says to keep offline backups separate from the network, that "Law enforcement do not encourage, endorse, nor condone" paying, and that attackers "will also threaten to publish data if payment is not made", so organisations should limit the impact of exfiltration.

Cyber Essentials, only where it is relevant. Version 3.3 of the requirements, dated April 2026, says "authentication to cloud services must always use MFA". That bears on any retailer whose customer messaging, CRM or data platform is a cloud service, and ASOS's account of a reached staff account is the nearest example. It says nothing about whether TFG London, ASOS or H&M holds a certificate, which I did not look up, or whether one would have changed anything.

What to do, in the order worth doing it

Two lists, one for customers and one for retailers and their suppliers. The order is this briefing's, drawn from the NCSC and ICO pages above and the gaps in this record. It is not a standard, and nothing here is advice about a particular company's exposure.

Method, interest and limits

Read directly, between 11:17 and 11:42 BST on 13 October 2026. The SENS notice on Sharenet's copy of the Johannesburg exchange's service (its page ticker showed TFG up 1.55% at 12:02 page time, a delayed market reading that says nothing about whether data was taken); the home pages of the three brands, and Phase Eight's FAQ, delivery and contact pages; the three brands' privacy policies; the TFG London group page; H&M Group's newsroom; the ICO's reporting page, guide, news page and ASOS statement; the UK GDPR Articles 33 and 34 on legislation.gov.uk; the Article 29 Working Party guidelines; the NCSC pages cited; and ASOS's RNS of 6 October.

Read as secondary, and used as pointers. The BBC, The Register, a Press Association copy, Brit Brief, Drapers, TheIndustry.fashion, Yahoo Finance UK, LBC and the Irish News. The Times is paywalled and only its headline and standfirst were read. The Telegraph blocked automated reads and was not used. Cybernews answered with a block and was not used. The customer email was not read in any form beyond what outlets quote. No leak site, channel or group page was visited.

Interest. TFG London's parent is listed in Johannesburg and wrote its notice for shareholders and the market, so it has reasons to be precise and to say little. H&M is listed in Stockholm and its statement has the same pull. ShinyHunters gains if a claim is believed, as the earlier briefing sets out. The outlets quoted compete on being first. None of those interests makes a statement false. They explain why each is quoted as a statement and not as a finding.

Limits. The 06:05 BST release time converts the notice's 07:05 South African time, and South Africa does not observe daylight saving. The Register's page prints a time of 10:45 labelled UTC, but its page data says 09:45 UTC, which is 10:45 BST; this briefing uses the page data. The Times's page data gives 14:15 BST while TheIndustry.fashion's gives 12:41 BST for a piece citing it, so the diagram uses "by 12:41". The 163 and 71 word counts are mine, counting hyphenated words once. The two-week count of retail briefings is a reading of titles. Work files and saved page texts are beside this briefing's source files.

The question that exposes the gap

If your own statement said "we do not believe payment information was affected" today, which log would you open to turn that belief into a finding by Wednesday, and how many days of it do you still hold?

Key facts