Britain’s JD Sports says customer data accessed in cyberattack

(Reuters) — British sports and fashion retailer JD Sports Fashion said Monday it has been the victim of a cyberattack that saw customer data related to online orders compromised.

The company said the affected data was “limited,” as it does not hold full payment card data and did not believe account passwords were accessed.

The attack related to online orders placed for the JD, Size?, Millets, Blacks, Scotts and MilletSport brands between November 2018 and October 2020.

JD Sports said information that may have been accessed consisted of the name, billing address, delivery address, email address, phone number, order details and the final four digits of payment cards of about 10 million customers.

The company apologized to customers and is contacting those affected to advise them to be vigilant to the risk of fraud and phishing attacks.

It is also investigating the incident, working with cybersecurity experts and engaging with the U.K.'s Information Commissioner's Office,  the country's data protection watchdog.

Cyberattacks on U.K. companies are becoming increasingly common.

Earlier this month the Royal Mail's export services were severely disrupted by what it described as “a cyber incident.”