Tesco has been forced to deactivate online customer accounts after thousands of login details, including passwords, were posted online.

A list of over 2,000 Tesco.com internet shopping accounts was posted online by hackers on Thursday, allowing access to online shopping accounts, personal details and Tesco Clubcard vouchers.



“We take the security of our customers’ data extremely seriously and are urgently investigating these claims,” a Tesco spokesman said in a statement.

The data is thought to have been compiled by hackers using stolen details from other web services, testing email and password combinations released in other high-profile hacks against Tesco’s website.

“We have contacted all customers who may have been affected and are committed to ensuring that none of them miss out as a result of this. We will issue replacement vouchers to the very small number who are affected,” added the Tesco spokesman.

Real and automated

The hackers appear to have managed to confirm 2,239 separate accounts, which still used the same username and password combination as the compromised data released in other hacks.



“The data released by the hackers shows signs of being created by automated tools,” said Rik Ferguson, vice-president of security research at Trend Micro, talking to the Guardian. “We can confirm that the data is real, that some of the login details do work, and that Tesco has deactivated some of the affected accounts.”



“We could not confirm that the login information released by the hackers came from other hacks,” explained Ferguson. “However, the presence of password data in cleartext in the leak certainly indicates that it wouldn’t be data extracted directly from Tesco in a database attack unless its passwords were stored in the clear and not encrypted as they should have been.”

Change your password, now

Users who have been affected are urged to check their other services that use the same or similar username and password combination, and change their passwords to something unique to avoid further repercussions. Passwords should be a mixture of numbers, punctuation and upper and lower letters.



“So far the information available indicates that the impact of this has been relatively limited – stolen vouchers – but if attackers have tried this on Tesco.com, the chances are they are also trying it on other sites too and so we may see additional fallout.” said Trey Ford, global security strategist at Rapid7.



Using the same username and password combination, such as a common email address and memorable password, across multiple sites may be easier to remember but makes it easier for hackers to steal your details from multiple sites.



Are your security questions really ‘secure’?

“Security or password reset questions are one of the most common ways to break into an account. If you are asked to provide answers to ‘security questions’ consider whether the answers are really secure – that you are the only one who can answer them,” said Ferguson. “If the possibility exists to create your own questions, use it. If you are obliged to answer more standard questions such as “first school” or “first pet” remember the answer doesn’t have to be the truth, it only has to be something you can remember.”

This is just the latest in a line of attacks targeting Tesco. In 2013, hundreds of Tesco Clubcard loyalty scheme users reported that their accounts had been compromised, with some seeing vouchers stolen and cashed in for Alton Towers tickets among other things.

It was suggested at the time that the Clubcard hacks were also caused by account holders using the same username and password combination on other compromised sites and services.



• What to do if your email or other account gets hacked, and how to prevent it happening again in the future.

