The Register: Harrods blames its supplier after crims steal 430k customers’ data in fresh attack

Sep 29, 2025

—

Source URL: https://www.theregister.com/2025/09/29/harrods_blames_thirdparty_supplier_after/
Source: The Register
Title: Harrods blames its supplier after crims steal 430k customers’ data in fresh attack

Feedly Summary: Attackers make contact but negotiations fall on deaf ears
Luxury London-based retailer Harrods is facing its second cybersecurity scandal in 2025, confirming criminals not only stole 430,000 customers’ data in a fresh attack but have even made contact.…

AI Summary and Description: Yes

Summary: The text describes a significant cybersecurity incident involving Harrods, a luxury London retailer that suffered a data breach leading to the theft of 430,000 customers’ data. The attackers attempted to engage in negotiations, which were reportedly ignored by the company, highlighting potential weaknesses in their incident response strategy. This incident is particularly relevant for professionals focusing on information security and compliance within the retail sector.

Detailed Description: This incident underscores several critical points pertinent to the fields of cybersecurity, particularly in the areas of information security and incident response.

– **Data Breach**: Harrods confirmed that 430,000 customers’ data was stolen, which could include sensitive information such as personal identification, payment details, and purchase history.
– **Criminal Engagement**: The attackers made contact, suggesting they might seek ransom or have demands for the stolen data. Ignoring such communications could have both ethical and legal implications.
– **Incident Response**: The fact that the company seemingly ignored communication attempts can indicate a weak incident response strategy. Organizations must have robust protocols in place for engaging with attackers in case of a data breach, as these interactions can sometimes be correlated with reducing the impact of such incidents.
– **Impact on Reputation**: This incident marks the retailer’s second cybersecurity scandal in 2025, which could lead to significant reputational damage, loss of customer trust, and possible regulatory scrutiny.
– **Compliance Implications**: With GDPR and other regulations in place, the loss of customer data raises questions about compliance, and the fallout from this breach could trigger regulatory investigations and potential fines.

This information serves as a vital reminder for professionals in security compliance roles, emphasizing the need for strong incident response plans, ongoing training in breach communication, and adherence to privacy regulations to mitigate risks associated with cybersecurity threats.

2 2025 3 4 5 a Act actions after age AGI AI All and art as at ated attack attacker attackers based bot breach by C CI CIA co Col communication compliance compliance implications core criminals critical custom Customer customer data customer trust cyber cybersecurit Cybersecurity cybersecurity incident cybersecurity threat cybersecurity threats D data data breach de demand e engagement ethical fact fine fines for g GDPR GIS Go H high Highlight HR http HTTPS impact implications in incident incident response incident response plan incident response plans incident response strategy information information security inter interaction interactions investigation investigations io k l Lead leading led Legal legal implications Li London M made man N negotiation negotiations NGO no o of on only ons organization organizations ory oS oss other out party pay payment per point potential privacy privacy regulation privacy regulations pro professionals protocol protocols ps Q question R Raise ransom rate RCE RDP re red Regulation regulations regulatory regulatory investigations regulatory scrutiny report reputation response Response Plan response strategy retail retail sector Risk risks Ro Role RoT Rust s sec sector security security and compliance security compliance security incident security threat security threats sensitive information Sig SoC source SSE SSO STIG stolen data Strategy T Tails ted text the theft third threat threats Time times to Tor TP training trust UN under up US V Wi x z