JD Sports data breach impacts 10 million unique customers

British sports fashion retailer JD Sports, which operates 3,402 stores in 32 territories, revealed that hackers stole the data of approximately 10 million unique customers.

In a data breach notification, the company stated that customers might be at risk from scammers. The breach involved a system containing customer data related to online orders placed between November 2018 and October 2020.

The security incident affected online customers of six of its sports fashion and outdoor clothing store brands, and the exposed information includes customers’ names, billing addresses, delivery addresses, email addresses, phone numbers, and order details. The data also includes the last four digits of a customer’s payment card. The company, however, has no reason to believe that account passwords were accessed.

According to customer notifications, the breach affected people in the UK and several other nations. JD Sports have advised customers to be alert for any shady or unusual communications posing as coming from JD Sports or any of our group brands.

Chief Financial Officer Neil Greenhalgh said that the company currently conducts a full cybersecurity review in partnership with external specialists following this incident. The company opted not to comment on the date the breach started, how it was discovered, or how and where all the customers it affected live. JD Sports said it had notified Britain’s Information Commissioner’s Office, which enforces the UK General Data Protection Regulation.