Loading story…
Harrods, the renowned London-based luxury retailer, has confirmed a significant data breach affecting 430,000 of its customers after a third-party supplier was compromised by cybercriminals. The company began notifying affected customers on September 26, informing them that their personal data had been accessed during the supplier breach. The stolen data includes basic personal details such as names and contact information, but does not encompass passwords or financial data, according to Harrods' official statements. Some records also contained marketing-related information, including Harrods membership tier levels and affiliations with co-branded cards, though the retailer believes this information would be difficult for unauthorized parties to interpret accurately. Harrods emphasized that its own internal systems were not targeted or compromised in the incident, and the breach was isolated to the unnamed third-party provider. The company has received direct communications from the threat actor responsible for the breach but has stated it will not engage with them. Harrods has reported the incident to all relevant authorities and is cooperating fully with ongoing investigations. The retailer has also reassured customers that the incident is unrelated to a previous cyberattack earlier in the year, which was attributed to the Scattered Spider group. In that earlier event, Harrods successfully blocked the attackers from accessing its systems, while other retailers such as Marks and Spencer and Co-op were also targeted. The current breach was first reported by UK media outlets after Harrods began customer notifications. The company operates a comprehensive e-commerce platform serving international customers, making the exposure of customer data particularly concerning. Harrods has not disclosed the identity of the compromised supplier, citing ongoing investigations and containment efforts. The company’s focus remains on supporting affected customers and maintaining transparency throughout the incident response process. No evidence has been presented to suggest that the compromised data has been used for fraudulent purposes at this time. Harrods has reiterated its commitment to data security and is reviewing its relationships with third-party suppliers to prevent similar incidents in the future. The breach highlights the ongoing risks associated with supply chain security in the retail sector. Customers have been advised to remain vigilant for potential phishing attempts or scams leveraging their exposed information. The incident underscores the importance of robust third-party risk management and timely communication with affected stakeholders.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Harrods publicly confirmed the new incident in late September 2025, saying the breach stemmed from a third-party provider and was isolated and contained. The company said it had notified affected customers and relevant authorities and warned customers to watch for phishing and social engineering.
After the supplier-linked breach, the threat actor contacted Harrods directly, which the company said was likely an extortion attempt. Harrods stated it would not engage with the attackers.
In a separate 2025 incident, attackers compromised an external supplier connected to Harrods' e-commerce operations and stole about 430,000 customer records. The exposed data included names and contact details, and for some customers internal marketing or service labels, but not passwords, payment data, or order histories.
In May 2025, Harrods said it stopped an attempted intrusion and restricted internet access across its sites as a defensive measure. The incident was later described as separate from the later customer-data breach and attributed to Scattered Spider.
10 references tracked. Mallory keeps watching after this page renders.
blog.usecure.io
Open sourcecomputing.co.uk
Open sourcescworld.com
Open sourcecyberpress.org
Open sourcehackread.com
Open sourceinfosecurity-magazine.com
Open sourcebleepingcomputer.com
Open sourcebbc.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Marks & Spencer said a cyberattack exposed customer personal data and caused prolonged disruption across its retail operations, including suspended online orders, store outages, delivery problems, and empty grocery shelves. The company said stolen information included names, dates of birth, home and email addresses, phone numbers, household details, and online order histories, prompting password resets for online accounts. UK authorities, including the National Cyber Security Centre, worked with affected retailers and law enforcement as the fallout spread beyond M&S. The attack has been linked in reporting to **Scattered Spider** and the **DragonForce** ransomware and extortion operation, with **Co-op** and **Harrods** also reported as targets around the same period. M&S later said the intrusion began through a contractor compromised via sophisticated social engineering rather than exploitation of a flaw in its own systems, and warned the impact would continue for months. The retailer estimated the incident would cut profits by about **£300 million**, with some losses expected to be offset through insurance and other recovery measures.
Jun 29, 2026
The Co-operative Group, a major British retailer, suffered a significant cyberattack in April that severely disrupted its operations and led to substantial financial losses. The attack forced the company to shut down parts of its IT systems, resulting in empty shelves and supply chain disruptions across its food retail business. Co-op reported a £206 million loss in revenue, with an £80 million hit to profits in the first half of 2025, marking a sharp reversal from the previous year's profit. The incident also triggered a one-off payment of £20 million, the purpose of which has not been publicly explained. Despite the company's efforts to contain the attack by proactively taking systems offline, the attackers managed to steal the personal details of all 6.5 million Co-op members, including names and contact information, though payment card and transaction data were reportedly not compromised. The breach led to weeks of operational chaos, with back-office functions seizing up and the company having to offer significant discounts to lure customers back. The Information Commissioner's Office is expected to investigate the exposure of such a large volume of personal data. Four individuals, including a minor, were arrested in July in connection with the hacks on Co-op and other UK retailers, with the attackers believed to have ties to the Scattered Spider cybercriminal group. Co-op's CEO, Shirine Khoury-Haq, stated that staff worked around the clock to restore operations and protect systems, and credited the company's structure for its resilience. The company managed to avoid a full-scale ransomware lockdown by disconnecting its networks, but the disruption still allowed competitors to take market share. The attack was part of a broader wave of cyber incidents affecting major UK retailers in the spring, including Marks & Spencer and Harrods. The financial impact of the attack was so severe that Co-op reported an underlying operating loss of £32 million, compared to a £47 million profit the previous year. The company has not confirmed whether a ransom was paid, and has not responded to media requests for further comment. The breach has raised concerns about the security of member data and the robustness of Co-op's cyber defenses. The incident underscores the growing threat of cyberattacks to critical retail infrastructure and the potential for widespread operational and financial damage.
Jun 29, 2026
London Hydro, a Canadian utility serving more than 160,000 customers, disclosed a security incident that may have exposed customer personal and account information. The potentially affected data includes names, home and service addresses, email addresses, phone numbers, account and billing numbers, pricing plans, contract start dates, and meter information. The company said banking details, payment card data, dates of birth, and government-issued identification numbers were not involved, and it has begun notifying affected individuals. The utility has not disclosed how the intrusion occurred, whether data was exfiltrated, how many customers were affected, or whether ransomware, extortion, third-party systems, or operational technology played a role. London Hydro warned that the exposed account details could make phishing, impersonation, and fraudulent billing scams more convincing, and advised customers to watch for suspicious communications, unexpected bills, unfamiliar account activity, and requests to change payment arrangements.
Jun 29, 2026