decrypted · 13 october 2026 · ransomware and cybercrime · supply chain · uk policy and law

A South African parent, three British fashion brands and the questions every board should ask

Since this morning's post, a fresh UK retail incident has surfaced. The Foschini Group (TFG), a South African retailer, told investors on Tuesday that a cyber incident has knocked out IT systems at three British fashion brands it owns: Phase Eight, Hobbs and Whistles. Stores are still trading. Whether customer data was taken, TFG says, it does not yet know. That uncertainty is the story, because it is where most boards find themselves on the worst day of their year.

What we know, and what we do not

TFG London identified the incident on Sunday 11 October. The company activated its incident response and business continuity plans, brought in outside specialists and reported the matter to the relevant UK authorities. TFG says it has no reason to believe payment information is at risk, and that customers need not change their passwords at this stage.

What it has not said is just as instructive. It has not described the type of incident, named the attackers or explained the way in. We should not fill that gap for it. Nothing published so far says this is ransomware, and calling it that would be guessing.

The wall that held

One detail deserves credit. TFG's operations in Africa and Australia run on separate IT systems and were unaffected, as were two other UK brands, Inside Story and White Stuff. Think of a ship with watertight compartments: a breach floods one section, not the whole vessel.

Segmentation is unglamorous and often loses the argument inside a growing group, because merging systems saves money and keeping them apart costs it. TFG London added White Stuff in October 2024, so this is a group that has been through integration, and the boundaries held this time. That is Secure by Design at its plainest: decide in advance how far one failure may travel, and pay for the walls before you need them.

A second incident, through a different door

TFG's June results disclosed a separate cyber incident at a key online concession partner, which hit its online sales. TFG London reported earnings down by more than 65%, with that incident cited as one contributing factor. There is no indication the two events are connected, and we do not suggest they are.

The point for UK directors is a general one. Your exposure includes the partners who run part of your shop window. Do your contracts say how quickly they must tell you when something goes wrong, and could you keep trading without them for a week?

Questions worth asking this week

Which systems share an identity or network with which others, and where exactly is the wall?
Could we take orders, pay staff and ship stock for a fortnight with our core systems off? Have we ever rehearsed it?
Who decides whether personal data is involved, and how fast can they get an answer?
If our parent company is listed abroad, who tells UK customers and regulators, and in what order?

The honest lesson is modest. We do not yet know how this began, and the facts may change as TFG investigates. What we can say is that the organisations that cope best are the ones that decided, before the incident, how far it could spread.

Also this week

Ledger: the implant in the box. Ledger confirmed this week that hardware wallets sold through a reseller, CryptoBilis, carried a hidden implant. Researchers cited by BleepingComputer say it captured the on-screen recovery phrase during setup and sent it out over LTE using an eSIM. Tampered units were reportedly sold at close to half the usual price, and the boards looked professionally manufactured rather than hand built. Ledger says its authenticity check cannot spot an implant if the original secure chip is intact. It describes the affected volume as limited and has not disclosed victim numbers, and how and when the devices were tampered with is still unknown. The design lesson is about procurement: a device is only as trustworthy as the channel it arrived through. UK buyers of anything security-critical should use authorised suppliers and treat a bargain price as a warning.

NCSC: a quantum pilot, not a panic. The NCSC runs a pilot assurance scheme for consultancies doing cryptographic discovery, the first step in migrating to post-quantum cryptography. It has two offerings: discovery and migration planning, and a narrower advice track for suppliers who meet the first standard. The pilot runs until 31 March 2027, when the NCSC will review the criteria, and it is closed to new expressions of interest. The sensible move is unglamorous: find out where your organisation uses cryptography before anyone asks you to replace it.

Sources

If you want a second pair of eyes on how far a single failure could travel in your own systems, get in touch.