Harrods says customers’ data stolen in IT breach

Luxury department store Harrods has warned customers their personal data may have been taken in an IT systems breach.

It said information like names and contact details of some online customers was taken from the systems of a third-party provider.

Harrods described the breach in an email sent to customers on Friday evening as an “isolated incident”, and that no passwords or payment details were taken.

It said in a statement: “The third party has confirmed this is an isolated incident which has been contained, and we are working closely with them to ensure that all appropriate actions are being taken. We have notified all relevant authorities.”

A spokesman for the store said that its own system had not been compromised, and that the breach is not connected to a cyber attack in May, when it restricted internet access across its sites as a precautionary measure following an attempt to gain unauthorised access to its systems.

A loosely linked group of hackers who claimed to be behind that cyber attack also claimed responsibility for high profile attacks on Marks & Spencer and the Co-op earlier this year.

In July the National Crime Agency arrested four people in connection to the hacks.

A 20-year-old woman was arrested in Staffordshire, and three males – aged between 17 and 19 – were detained in London and the West Midlands. All have since been released on bail.

Another group claimed they were behind a cyber attack in August which halted the global production lines of Jaguar Land Rover (JLR) until earlier this week.

Richard Horne, chief executive of National Cyber Security Centre, said cyber attacks may sound theoretical and technical, but have “real world impact on real people”.

“Increasingly the attackers are getting good at causing those impacts, they’re refining their techniques,” he told BBC Radio 4’s Today programme on Saturday.

“These criminal attackers… they don’t care who they hit, and they don’t care how they hurt them.

“All organisations, big and small, regardless of whether you think of yourself as critical to the nation or not, to protect you and to protect your customers there are things that have to be done to secure your system.”