WH Smith says hackers accessed the data of current and former employees

High street retailer WH Smith says it has suffered a data security incident that compromised the data of current and former employees.

In a cyber security incident notice filed with the London Stock Exchange earlier today, WH Smith said it suffered a cyber security incident that “resulted in illegal access to some company data, including current and former employee data”.

The company said that after it became aware of the security incident, it launched an internal investigation and engaged third party specialist to understand the scope of the cyber attack. It has also implemented incident response plans that include notifying all relevant authorities.

“WH Smith takes the issue of cyber security extremely seriously and investigations into the incident are ongoing. We are notifying all affected colleagues and have put measures in place to support them,” the company said in its statement.

The company confirmed that the cyber attack has not affected its trading activities and that its website, customer accounts and underlying customer databases are on a different server which wasn’t impacted by the security incident.

WH Smith is yet to confirm the number of affected employees or the nature of the cyber attack, but the fact that it has thousands of employees across High Street stores and outlets at railway stations and airports possibly puts many individuals at risk.

The Information Commissioner’s Office (ICO) has confirmed that it is aware of the cyber attack and is investigating the incident.

Paul Bischoff, Consumer Privacy Advocate at Comparitech, says that current and former employees at WH Smith should be on the lookout for targeted scams and phishing messages and should file their taxes now to make sure no one else can file taxes in their name.

Bischoff also advised affected employees to avoid clicking on links or attachments in unsolicited messages and check their credit reports, bank accounts, and benefits (e.g. health insurance) regularly to ensure their identities haven’t been stolen.