Blog

Sportswear chain JD Sports has said stored data relating to 10 million customers might be at risk after it was hit by a cyber-attack.

The company said information that “may have been accessed” by hackers included names, addresses, email accounts, phone numbers, order details and the final four digits of bank cards.

The data related to online orders between November 2018 and October 2020. 

JD Sports said it was contacting affected customers.

The group said the affected data was “limited”. It added it did not hold full payment card details and did not believe that account passwords were accessed by the hackers.

“We want to apologise to those customers who may have been affected by this incident,” said Neil Greenhalgh, chief financial officer of JD Sports. “Protecting the data of our customers is an absolute priority for JD.”

The attack related to online orders placed for the JD, Size?, Millets, Blacks, Scotts and MilletSport brands and it is understood it was detected by the company in recent days, but only the historical data was accessed.

The company said it was working with “leading cyber-security experts” and was engaging with the UK’s Information Commissioner’s Office (ICO) in response to the incident.

Mr Greenhalgh said affected customers were being advised “to be vigilant about potential scam e-mails, calls and texts”.

Cyber-attacks have hit several UK companies in recent times. Royal Mail became the victim of a ransomware attack earlier this month which led to it halting post and parcel deliveries overseas.

In December, the Guardian newspaper was also targeted by a suspected ransomware attack.

Lauren Wills-Dixon, solicitor and an expert in data privacy at law firm Gordons, said retailers were among the most common targets for cyber-attacks because of the large amounts of customer data they hold, and said firms needed to do more to plan for them.

But she said the increased use of technology by the industry “to reduce overheads and streamline operations has raised the risk even further”. 

“In this new world, it’s not ‘if’ but ‘when’ a cyber-attack will happen,” she said. 

A spokeswoman for the ICO confirmed it was aware of the attack and that it was assessing information provided by JD Sports. 

Scott Nicholson, co-chief executive of cyber security company Bridewell, said it was seeing a rise in malicious software, known as “malware” being used by criminals to steal information from companies.

“It is good to see JD Sports stating that they are working with experts to help from a containment and recovery perspective, but once the dust has settled their comments of ‘we take the protection of customer data extremely seriously’ will be put to the test by the ICO,” he added.

Dr. Phil, the US talkshow that saw Dr Phil McGraw divvy out life advice to individuals and which became a regular on daytime television around the world, is set to end later this year after 21 seasons.

Hosted by McGraw since 2002, the show saw him advise guests who were troubled by problems, often to do with their finances, weight, families, addictions and marriages.

“I have been blessed with over 25 wonderful years in daytime television,” McGraw said in a statement. “With this show, we have helped thousands of guests and millions of viewers through everything from addiction and marriage to mental wellness and raising children. This has been an incredible chapter of my life and career, but while I’m moving on from daytime, there is so much more I wish to do.”

CBS sources told Variety that McGraw made the call to end production on the show, which airs five days a week in the US.

McGraw, 72, first became known after appearing as a guest speaker on Oprah Winfrey’s talkshow in the 1990s and was soon famous for his folksy, straight-shooting advice. Dr Phil was initially produced by Winfrey’s Harpo Productions.

While McGraw holds a doctorate in clinical psychology, he stopped renewing his licence to practise in 2006.

The show’s use of psychology as entertainment was often controversial, with some criticising its treatment of mentally ill and vulnerable guests. In 2004, when McGraw likened a nine-year-old boy to a serial killer, the National Alliance for the Mentally Ill wrote to CBS saying “Dr. Phil’s conduct is serious enough to warrant investigation by a relevant board of licensure.” A spokesperson for McGraw said the letter was “based on lack of information and inaccurate, inappropriate assumptions”.