Superdrug has advised its online customers to change their passwords after the high street chain was targeted by hackers claiming to have stolen the personal details of thousands of people.
The health and beauty retailer told customers it had been contacted by a group on Monday evening claiming to have obtained the details of 20,000 customers, including names, addresses, dates of birth and phone numbers.
Superdrug said in the email to customers the company had only seen evidence so far that 386 of the accounts had been compromised.
A spokeswoman said: “The hacker shared a number of details with us to try to prove he had customer information – we were then able to verify they were Superdrug customers from their email and log-in.”
To customers who have received an email from us today, this email is genuine. We recommend you follow the steps we outlined.
— Superdrug (@superdrug) August 21, 2018
The company said the information stolen did not include payment card information.
“We believe the hacker obtained customers’ email addresses and passwords from other websites and then used those credentials to access accounts on our website,” it said.
Advising customers to change their passwords, Superdrug added: “We take our responsibility to protect your personal information very seriously and that is why we have let our customers know as soon as we could.
“We have contacted the police and Action Fraud [the UK’s national fraud and cyber-crime arm] and will be offering them all the information they need for their investigation.”
Superdrug said it was aware that some customers had found they were unable to change their passwords when trying to do so and apologised for the inconvenience.
“We appreciate this is very frustrating and we are doing everything we can on this,’ the company said.
One customer said she had tried and failed to change her password on four different devices.
I would be able to change my password but tried from 4 different devices and the website keeps giving me and internal server error. Not acceptable that I might have my details comprised and I can't change my password.
— Ellen Auckland (@EllenA1997) August 21, 2018
Superdrug is the latest high street retailer to report a data breach. Last month Dixons Carphone said personal data belonging to 10 million customers may have been accessed illegally last year, nearly 10 times as many as the firm initially thought.
The electronics retailer had estimated the attack – one of the biggest-ever data breaches – involved 1.2m personal records when it first reported the breach in June.
