British retailer JD Sports Fashion has confirmed that around ten million of its customers have been affected by a cybersecurity incident.

The hackers reportedly accessed a system that stored customer data relating to online orders between November 2018 and October 2020.

Brands affected by the incident are JD, Size?, Millets, Blacks, Scotts and MilletSport.

JD Sports said the data breach is ‘limited’ and may include names, email addresses, phone numbers, order details and billing and delivery addresses, as well as the final four digits of payment cards.

JD Sports expects customers’ account passwords to be safe, as it does not store all their payment card data.

The retailer is working with leading cybersecurity experts and relevant authorities, including the UK’s Information Commissioner’s Office (ICO), to investigate the incident.

It has contacted affected customers to keep them aware of the fraud and phishing attacks.

JD Sports chief financial officer Neil Greenhalgh said: “We want to apologise to those customers who may have been affected by this incident.

“We are advising them to be vigilant about potential scam emails, calls and texts and providing details on how to report these.

“We are continuing with a full review of our cybersecurity in partnership with external specialists following this incident.

“Protecting the data of our customers is an absolute priority for JD.”

In October last year, US-based homeware retailer Bed Bath & Beyond confirmed that an outside party had improperly accessed its data.

The retailer did not believe any sensitive or personally identifiable information was accessed through the phishing scam.

Last month, JD Sports sold 15 of its non-core fashion businesses in the UK to Frasers Group for up to £47.5m ($58.5m) in cash.

The brands included Base Childrenswear, Choice, Clothingsites, Cricket, Giulio and Kids Cavern, as well as Pretty Green, Prevu Studio and Rascal Clothing.