D Sports has warned that about 10 million people may have had their addresses, phone numbers and emails stolen in a hack that hit the retailer.
The company said the payment card details were secure and it has no reason to believe that the hackers gained access to users’ passwords.
Hackers gained access to a system that contained information about orders placed by JD Sports customers between November 2018 and October 2020, the company said.
The affected brands include JD, Size?, Millets, Blacks, Scotts and MilletSport.
We are proactively reaching out to affected customers so we can advise them to be vigilant about the risk of fraud and phishing attacks
The intruders could have accessed billing, delivery and email addresses, full names, phone numbers, details of orders customers have placed and the last four digits of their payment cards.
JD warned customers to be vigilant about potential fraudsters who could use this information to target customers and convince the customers that they are calling, emailing or texting from JD.
“We would like to apologize to the customers who may have been affected by this incident,” said Chief Financial Officer Neil Greenhalgh.
“We advise them to be vigilant for potential scam emails, phone calls and text messages and provide details on how to report them.
“Following this incident, we are continuing with a full assessment of our cyber security in collaboration with external specialists.
“Protecting our customers’ data is an absolute priority for JD.”
The company said it would proactively contact customers whose data may have been compromised in the breach.
It is the latest in a series of recent high-profile cyber attacks on UK businesses.
Last Thursday, Royal Mail was able to resume international registered mail for business customers.
The company was forced to withdraw some overseas delivery options after being hit by what was reportedly a ransomware attack.
JD Sports said on Monday: “We have taken the necessary immediate steps to investigate and respond to the incident, including by working with leading cybersecurity experts.
“We are cooperating with the relevant authorities where appropriate, including the UK Information Commissioner’s Office (ICO).
“We are proactively reaching out to affected customers so that we can advise them to be vigilant about the risk of fraud and phishing attacks.
“This includes looking for suspicious or unusual communications purporting to come from JD Sports or one of our group brands.”
