JD Sports, a British-based sports fashion retailer with outlets around the globe, says hackers stole data pertaining to “approximately 10 million unique customers.”
The company says the breach stems from a system containing customer data “relating to some online orders placed between November 2018 and October 2020” and that customers are at risk from scammers.
The company, which trades on the London Stock Exchange and is majority owned by London-based Pentland Group, operates thousands of physical stores in multiple countries.
In a Monday data breach notification, the company says the security incident affects online customers of six of its sports fashion and outdoor clothing store brands: JD, Size?, Millets, Blacks, Scotts and MilletSport.
Exposed information includes a customer’s name, billing address, delivery address, email address, phone number and order details. It also includes the last four digits of a customer’s payment card. The company says it does not store full payment card data.
