Tesco issues 620,000 new Clubcards after data attack
The supermarket believes hackers used stolen usernames and passwords from other websites
4th March 2020 15:56
by Stephen Little from interactive investor
The supermarket believes hackers used stolen usernames and passwords from other websites
Tesco is reissuing 620,000 new Clubcards to customers after criminals tried to hack accounts.
The supermarket giant believes the hackers stole passwords and usernames from other websites and then tried using them to redeem vouchers.
Tesco says it has contacted 620,000 Clubcard holders who may have been affected by the breach.
The company says no financial data was compromised and that all affected vouchers have been cancelled.
It has apologised for the inconvenience and assured customers that no Clubcard points or vouchers will be lost.
Customers will be able to carry on using their current card until a new one is issued.
A Tesco spokesperson says: “We are aware of some fraudulent activity around the redemption of a small proportion of our customers’ Clubcard vouchers. We have strict security measures in place and our priority is protecting our customers.
“Our internal systems picked this up quickly and we immediately took steps to protect our customers and restrict access to their accounts.
“We have asked customers affected to reset their passwords and are contacting customers whose Clubcard vouchers may have been affected to let them know that we will replace these vouchers and issue new Clubcards, as a precaution.”
Around 19 million people have a Clubcard account.
Clubcard holders were made aware of issue after they were sent an email by Tesco.
In 2014, Tesco was forced to suspend over 2,000 online shopping accounts after details were posted online.
Its banking division was also fined £16.4 million in 2018 after a cyber attack that saw £2.26 million stolen from customers in 48 hours.
Tesco Clubcard was first launched in 1995 and then relaunched in 2018 with contactless cards.
With Tesco Clubcard you collect one Clubcard point for every £1 you spend in Tesco and one point for every £8 you spend everywhere else. The points can be turned into vouchers, so 150 points are worth £1.50.
What can you do?
Experts believe that incidents like this are exacerbated by users using the same log-in for multiple accounts.
Make sure you change the passwords on all your accounts. Be sure to use a strong password that is unique and contains letters, numbers and symbols.
Stewart Room, head of data protection and cybersecurity at multinational law firm DWF, says: “This breach is about the balancing act between security and convenience and highlights the dangers of relying on passwords as a single form of authentication.
“This incident should be a lesson for customers to not use the same password for multiple accounts. If cyber criminals manage to use stolen credentials once, in all likelihood they'll be trying the credentials on other sites too.”
If you are worried that your email has been compromised, you can check on the website haveibeenpawned.com.
This article was originally published in our sister magazine Moneywise, which ceased publication in August 2020.
These articles are provided for information purposes only. Occasionally, an opinion about whether to buy or sell a specific investment may be provided by third parties. The content is not intended to be a personal recommendation to buy or sell any financial instrument or product, or to adopt any investment strategy as it is not provided based on an assessment of your investing knowledge and experience, your financial situation or your investment objectives. The value of your investments, and the income derived from them, may go down as well as up. You may not get back all the money that you invest. The investments referred to in this article may not be suitable for all investors, and if in doubt, an investor should seek advice from a qualified investment adviser.
Full performance can be found on the company or index summary page on the interactive investor website. Simply click on the company's or index name highlighted in the article.