Advertisement

  1. ITV Report

Dixons Carphone admits huge data breach after cyber attack

Retailer Dixons Carphone has become the latest victim of a cyber attack. Photo: PA

Retailer Dixons Carphone has become the latest victim of a cyber attack after revealing 5.9 million customer bank card details and 1.2 million personal data records were hacked.

The group said that, while 5.8 million of the payment cards targeted were protected by chip and pin, around 105,000 non-EU cards without chip and pin protection were compromised.

Dixons Carphone said relevant card companies had been notified, but added that there was no evidence of fraud on the cards as a result of the incident.

The hack comes just months after the firm was fined over a 2015 breach which also exposed customer data.

Dixons says that it doesn't believe any fraud was carried out. Credit: PA

It added that its investigation had also found that hackers accessed non-financial personal data – such as name, address or email details – for 1.2 million customer records.

The group is contacting all those affected, but sought to assure customers it had no evidence that this had resulted in fraud at this stage.

It said it had called in cyber experts and added extra security to its systems following the breach, while also since calling in the police and relevant authorities.

The Information Commissioner's Office (ICO) said it had been informed of the incident, and that they were liaising with the National Cyber Security Centre and the Financial Conduct Authority.

We are extremely disappointed and sorry for any upset this may cause.

The protection of our data has to be at the heart of our business, and we’ve fallen short here.

– Dixons Carphone

Dixons Carphone chief executive Alex Baldock admitted the group had “fallen short” of its responsibility to protect customer data.

He said: “We are extremely disappointed and sorry for any upset this may cause.

“The protection of our data has to be at the heart of our business, and we’ve fallen short here.

“We’ve taken action to close off this unauthorised access and, though we have currently no evidence of fraud as a result of these incidents, we are taking this extremely seriously.”

The hack took place inside the retailer's processing system. Credit: PA

Dixons said the hack occurred in one of the processing systems of Currys PC World and Dixons Travel stores.

It said the data accessed did not contain Pin codes, card verification values (CVV) or any authentication data allowing cardholder identification or a purchase to be made.

The group added it did not believe the personal data accessed had left the group’s systems, but was advising those affected on protective steps they should take.

It comes after telecoms firm TalkTalk was hit by a major cyber attack in October 2015, which saw the personal data of nearly 160,000 people accessed by hackers and left the firm facing a record £400,000 fine for security failings.

Dixons itself was fined £400,000 by the ICO in January after a 2015 cyber attack exposed the data of more than three million customers.