Harrods ‘won’t engage’ with hackers after new cyber attack

Department store tells customers data stolen but no bank details acquired

Harrods in Knightsbridge, West London, has been affected by cyber attacks twice this year. Getty Images

Luxury London department store Harrods has refused to engage with hackers who contacted the company after a cyber attack involving 430,000 customer records.

It is the second time this year that the Knightsbridge store has been targeted by cyber criminals.

Victims are advised by security services not to pay ransoms to hackers trying to blackmail a company by threatening to release sensitive data.

Jaguar Land Rover cyber attack is a ‘shockwave’ rippling through British industry

Read More

Harrods warned its e-commerce customers on Friday information, such as names and contact details, were taken after one of its third-party provider systems had been compromised.

The breach is unconnected to attempts to gain unauthorised access to Harrods systems earlier in the year, the company said.

A Harrods statement read: “We have received communications from the threat actor and will not be engaging with them.”

It said the data was limited to basic personal identifiers and did not include account passwords or payment details.

“Affected customer records may also have labels related to marketing and services delivered by Harrods,” it said. “These labels may include tier level or affiliation to a Harrods co-branded card, although this information is unlikely to be interpreted accurately by an unauthorised third party.

“We would like to reiterate that no payment details or order history information has been accessed and the impacted personal data remains limited to basic personal identifiers as advised previously.

“It is important to note that the information was taken from a third-party provider and is unconnected to attempts to gain unauthorised access to some Harrods systems earlier this year.”

After the attack, which emerged on Friday, Harrods said the third party had confirmed the “isolated” incident had been contained.

In May, Harrods reacted to an attempted breach by restricting internet access across its sites in a precautionary measure.

In July, two men aged 19, a 17 year-old boy and a 20-year-old woman who were arrested over suspected involvement in cyber attacks against Marks & Spencer, the Co-op and Harrods, were bailed pending further inquiries.

They were arrested on suspicion of blackmail, money laundering, offences linked to the Computer Misuse Act, and participating in the activities of an organised crime group, the National Crime Agency said.

A Jaguar Land Rover manufacturing plant in Castle Bromwich, UK, where production shut down after a cyber attack. Bloomberg

The UK government stepped in with a rescue plan after Jaguar Land Rover (JLR) was faced with a shutdown following a mass cyber attack.

The government will underwrite a £1.5 billion ($2.02 billion) loan guarantee to the car maker, which has been forced to suspend production at its UK factories for several weeks after being targeted by hackers.

The shutdown is expected to last until October 1 at the earliest, leaving the company’s suppliers in limbo.

The loan, from a commercial bank, is expected to provide those suppliers with some certainty.

JLR’s travails came on the heels of a cyber crime spring and summer in which it was joined by retailers Marks & Spencer and Harrods and the supermarket chain Co-op in suffering devastating business interruptions.