British retailer JD Sports Fashion has confirmed that around ten million of its customers have been affected by a cybersecurity incident.
The hackers reportedly accessed a system that stored customer data relating to online orders between November 2018 and October 2020.
Go deeper with GlobalData
Brands affected by the incident are JD, Size?, Millets, Blacks, Scotts and MilletSport.
JD Sports said the data breach is ‘limited’ and may include names, email addresses, phone numbers, order details and billing and delivery addresses, as well as the final four digits of payment cards.
JD Sports expects customers’ account passwords to be safe, as it does not store all their payment card data.
The retailer is working with leading cybersecurity experts and relevant authorities, including the UK’s Information Commissioner’s Office (ICO), to investigate the incident.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataIt has contacted affected customers to keep them aware of the fraud and phishing attacks.
JD Sports chief financial officer Neil Greenhalgh said: “We want to apologise to those customers who may have been affected by this incident.
“We are advising them to be vigilant about potential scam emails, calls and texts and providing details on how to report these.
“We are continuing with a full review of our cybersecurity in partnership with external specialists following this incident.
“Protecting the data of our customers is an absolute priority for JD.”
In October last year, US-based homeware retailer Bed Bath & Beyond confirmed that an outside party had improperly accessed its data.
The retailer did not believe any sensitive or personally identifiable information was accessed through the phishing scam.
Last month, JD Sports sold 15 of its non-core fashion businesses in the UK to Frasers Group for up to £47.5m ($58.5m) in cash.
The brands included Base Childrenswear, Choice, Clothingsites, Cricket, Giulio and Kids Cavern, as well as Pretty Green, Prevu Studio and Rascal Clothing.
