Harrods warns online customers of data breach affecting names and contact details
Harrods says personal data exposed in a breach tied to a third‑party provider; passwords and payment data not affected; incident described as isolated
LONDON — Harrods said late Friday that a breach of its online systems may have exposed basic personal identifiers for some online customers. The luxury retailer said the breach involved a third‑party provider system and that some names and contact details were taken. "We have informed affected customers that the impacted personal data is limited to basic personal identifiers including name and contact details, but does not include account passwords or payment details," the company said. The incident is described by Harrods as isolated and contained, with the company stressing that no passwords or payment data were compromised.
Harrods noted that the breach was not connected to an incident in May, when it restricted internet access across its sites as a precaution after an attempt to gain unauthorized access to its systems. The company said the May event was separate from the current breach and took place before the third‑party system was compromised.
The Associated Press reported that four people were arrested in July on suspicion of involvement in cyberattacks targeting Harrods and two other leading British retailers, Marks & Spencer and the Co‑op. The suspects were bailed pending further inquiries. The police have not disclosed any charges at this stage or released identities.
The case comes amid a wave of cyberattacks on high‑profile British businesses. Jaguar Land Rover said on Friday that production lines will remain shut until at least Oct. 1 after a cyberattack in August disrupted operations. Separately, British media reported that hackers stole information about thousands of children from Kido, a London nursery chain, posting some of the children’s photos and details on the darknet. Police officials described inquiries into a ransomware attack on a London‑based organization as ongoing, with no arrests announced at this time. In the broader market, executives have stressed the importance of robust cyber defenses and rapid breach notification to maintain consumer trust after incidents like this.