Luxury department store Harrods has disclosed a significant data breach affecting approximately 430,000 customer records after a third-party provider was compromised.
The hackers behind the attack have contacted the retailer, but Harrods has stated it will not engage with the threat actor, suggesting a potential ransom demand was made.
The breach, which Harrods first communicated to affected customers via email on Friday, September 26, 2025, originated from a security failure at an unnamed external supplier, not from Harrods’ internal systems.
The company has emphasized that the compromised data is limited to basic personal identifiers and does not include highly sensitive information.
Harrods Data Breach
The stolen data primarily includes names and contact details that customers had provided. In some cases, information related to marketing preferences, loyalty program status, and affiliations with Harrods’ co-branded credit cards was also exposed.
However, a company spokesperson noted that this marketing-related data is “unlikely to be interpreted accurately by an unauthorised third party”.
Harrods has reassured its customers that no financial information, such as payment card details or account passwords, was accessed during the incident. The breach is understood to have affected a small proportion of the store’s total clientele, as the majority of Harrods customers shop in-store rather than online.
In response to the incident, Harrods has proactively informed affected e-commerce customers and notified all relevant authorities, including the Information Commissioner’s Office (ICO), in compliance with UK GDPR regulations.
A spokesperson stated, “Our focus remains on informing and supporting our customers. We have informed all relevant authorities and will continue to co-operate with them”.
This security event is separate from a previous cyberattack attempt on Harrods’ internal systems in May 2025. That earlier incident, part of a wider series of attacks on UK retailers like M&S and Co-op, prompted Harrods to restrict internet access as a precaution but did not result in a data compromise at the time.
The recent breach highlights a growing trend of cybercriminals targeting supply chain partners as a weaker link to access data from major corporations. Customers of Harrod’s online store are advised to be vigilant against potential phishing and social engineering attempts.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
