Tesco warns 620,000 Clubcard holders after data attack

Tesco stressed that no customers would lose Clubcard vouchers or points accrued and sent new physical cards to those who use them.

The retailer has reported the incident to the ICO but does not expect to pay a fine as customers financial details were not exposed. Sources close to the company pointed out the group of 620,000 represented just 3% of Clubcard’s 19 million members.

Although Tesco’s systems were not compromised it is a shot across the bows of the group. Its Tesco Bank arm was fined £16.4 million in 2018 after a 2016 cyber attack saw criminals steal over £2 million from 34 accounts.

A Tesco spokeswoman said: "Our internal systems picked this up quickly and we immediately took steps to protect our customers and restrict access to their accounts. At no point was any customer’s financial data accessed.

“We believe that someone has stolen password/username combinations from other website(s) and used them to try to access Tesco sites - where customers used the same username and password. We have asked customers affected to reset their passwords and are contacting customers whose Clubcard vouchers may have been affected to let them know that we will replace these vouchers and issue new Clubcards, as a precaution.

“We are sorry for any inconvenience this may cause.”