Tesco calls the police as online Clubcard accounts compromised

Retail giant says the number of affected accounts is small

Tesco has confirmed that it has called in the police to investigate a possible data breach after a number of complaints from Clubcard members who claim to have had their online accounts compromised.

Clubcard holders informed moneysavingexpert.com that they have found hundreds of pounds worth of vouchers missing from their accounts, with vouchers being spent miles away from where they live, as well as some claiming that their account details have been changed.

Tesco told Computerworld UK that the number of compromised accounts is less than 100 and it is working with the relevant authorities to resolve the issue. The retail giant has 16 million Clubcard members.

"We have launched a thorough investigation into a small number of incidents and referred the matter to the police," said a spokesperson for Tesco.

"In the meantime, we'd like to ask any customers who believe they're affected to contact us directly so that we can make sure their accounts are up to date."

This isn't the first time Tesco's security practices have been brought into question. In August last year the UK's Information Commissioner's Office confirmed that it was 'making enquiries' intoa number of security concerns that had been raised regarding Tesco's customer facing website.

Security researcher Troy Hunt detailed in a blog that he had received a password reminder in an email from Tesco that contained his password in plain text.

Hunt wrote: "Righto, so how exactly was that password protected in email? Well, of course it wasn't protected at all, it was just sent off willy nilly."

Hunt was prompted by his experience to investigate additional security aspects of Tesco's website.

One thing he identified was that although users log into the Tesco website over HTTPS, which "implies a degree of security", the browser reverted back to HTTP, which does not give users security assurances. Hunt said that this can cause problems for data protection and make users vulnerable to hacking.

Tags: security, Tesco, Information Commissioner's Office, IT Business

How to keep your smartphone (and its data) secure

READ THIS ARTICLE
DO NOT SHOW THIS BOX AGAIN [ x ]
Comments are now closed.
CSO Corporate Partners
  • Webroot
  • Trend Micro
  • NetIQ
rhs_login_lockGet exclusive access to CSO, invitation only events, reports & analysis.
CSO Directory

Webroot SecureAnywhere Business

The lightest, fastest, easiest-to-manage, and most effective endpoint protection.

Latest Jobs
Security Awareness Tip

Incident handling is a vast topic, but here are a few tips for you to consider in your incident response. I hope you never have to use them, but the odds are at some point you will and I hope being ready saves you pain (or your job!).


  1. Have an incident response plan.

  2. Pre-define your incident response team 

  3. Define your approach: watch and learn or contain and recover.

  4. Pre-distribute call cards.

  5. Forensic and incident response data capture.

  6. Get your users on-side.

  7. Know how to report crimes and engage law enforcement. 

  8. Practice makes perfect.

For the full breakdown on this article

Security ABC Guides

Warning: Tips for secure mobile holiday shopping

I’m dating myself, but I remember when holiday shopping involved pouring through ads in the Sunday paper, placing actual phone calls from tethered land lines to research product stock and availability, and actually driving places to pick things up. Now, holiday shoppers can do all of that from a smartphone or tablet in a few seconds, but there are some security pitfalls to be aware of.