JD is a global omnichannel sports fashion retailer. Credit: DPP Law / Flickr (Creative Commons).

British retailer JD Sports Fashion has confirmed that around ten million of its customers have been affected by a cybersecurity incident.

The hackers reportedly accessed a system that stored customer data relating to online orders between November 2018 and October 2020.

Go deeper with GlobalData

Data Insights

The gold standard of business intelligence.

Find out more

Related Company Profiles

View all

Brands affected by the incident are JD, Size?, Millets, Blacks, Scotts and MilletSport.

JD Sports said the data breach is ‘limited’ and may include names, email addresses, phone numbers, order details and billing and delivery addresses, as well as the final four digits of payment cards.

JD Sports expects customers’ account passwords to be safe, as it does not store all their payment card data.

The retailer is working with leading cybersecurity experts and relevant authorities, including the UK’s Information Commissioner’s Office (ICO), to investigate the incident.

How well do you really know your competitors?

Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.

Company Profile – free sample

Thank you!

Your download email will arrive shortly

Not ready to buy yet? Download a free sample

We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form

By GlobalData
Visit our Privacy Policy for more information about our services, how we may use, process and share your personal data, including information of your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.

It has contacted affected customers to keep them aware of the fraud and phishing attacks.

JD Sports chief financial officer Neil Greenhalgh said: “We want to apologise to those customers who may have been affected by this incident.

“We are advising them to be vigilant about potential scam emails, calls and texts and providing details on how to report these.

“We are continuing with a full review of our cybersecurity in partnership with external specialists following this incident.

“Protecting the data of our customers is an absolute priority for JD.”

In October last year, US-based homeware retailer Bed Bath & Beyond confirmed that an outside party had improperly accessed its data.

The retailer did not believe any sensitive or personally identifiable information was accessed through the phishing scam.

Last month, JD Sports sold 15 of its non-core fashion businesses in the UK to Frasers Group for up to £47.5m ($58.5m) in cash.

The brands included Base Childrenswear, Choice, Clothingsites, Cricket, Giulio and Kids Cavern, as well as Pretty Green, Prevu Studio and Rascal Clothing.