We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Tesco calls the police as online Clubcard accounts compromised

Retail giant says the number of affected accounts is small

Tesco has confirmed that it has called in the police to investigate a possible data breach after a number of complaints from Clubcard members who claim to have had their online accounts compromised.

Clubcard holders informed moneysavingexpert.com that they have found hundreds of pounds worth of vouchers missing from their accounts, with vouchers being spent miles away from where they live, as well as some claiming that their account details have been changed.

Tesco told Computerworld UK that the number of compromised accounts is less than 100 and it is working with the relevant authorities to resolve the issue. The retail giant has 16 million Clubcard members.

"We have launched a thorough investigation into a small number of incidents and referred the matter to the police," said a spokesperson for Tesco.

"In the meantime, we'd like to ask any customers who believe they're affected to contact us directly so that we can make sure their accounts are up to date."

This isn't the first time Tesco's security practices have been brought into question. In August last year the UK's Information Commissioner's Office confirmed that it was 'making enquiries' intoa number of security concerns that had been raised regarding Tesco's customer facing website.

Security researcher Troy Hunt detailed in a blog that he had received a password reminder in an email from Tesco that contained his password in plain text.

Hunt wrote: "Righto, so how exactly was that password protected in email? Well, of course it wasn't protected at all, it was just sent off willy nilly."

Hunt was prompted by his experience to investigate additional security aspects of Tesco's website.

One thing he identified was that although users log into the Tesco website over HTTPS, which "implies a degree of security", the browser reverted back to HTTP, which does not give users security assurances. Hunt said that this can cause problems for data protection and make users vulnerable to hacking.


IDG UK Sites

Nexus 6 vs Sony Xperia Z3 comparison: Lollipop phablet takes on KitKat flagship smartphone

IDG UK Sites

Why people aren't upgrading to iOS 8: new features are for power users, not the average Joe

IDG UK Sites

Free rocket & space sounds: NASA launches archive of interstellar audio on SoundCloud

IDG UK Sites

iPad Air 2 review: Insanely fast and alarmingly thin. Speed tests, camera tests, beautiful...