WH Smith Hit by Cyber-Attack Targeting Employee Data UK-based retailer WH Smith has confirmed a cyber-attack that compromised personal data belonging to current and former employees. The breach, detected earlier this week, exposed sensitive information, including names, addresses, National Insurance numbers, and dates of birth. The company, which employs around 10,000 people across its High Street stores and transport hubs, stated that its trading operations, customer accounts, and databases remain unaffected, as these systems are separate from those targeted. The Information Commissioner’s Office (ICO) has been notified and is investigating the incident. WH Smith has begun notifying affected staff and implementing support measures. While the exact number of impacted individuals remains undisclosed, the breach highlights the growing vulnerability of retailers, which hold vast amounts of employee and customer data. Legal experts note that such attacks pose heightened risks, including identity theft and reputational damage, due to the sensitive nature of the exposed information. This incident follows a 2023 cyber-attack on WH Smith’s subsidiary, Funky Pigeon, which disrupted online orders for several days. The retail sector remains a prime target for cybercriminals, with recent high-profile breaches affecting companies like JD Sports and Royal Mail. WH Smith has emphasized its commitment to cybersecurity as investigations continue.

Retailer WH Smith stated that threat actors had accessed the data of about 12,500 current and former workers after breaching its infrastructure. With the aid of specialised support services, the company started an inquiry into the situation right once. It also alerted the appropriate authorities. All impacted employees have been informed by the corporation, which has also disclosed that it has taken steps to help them. Although the warning lacks specifics regarding the attack, the harm it reports is consistent with a ransomware attack.

WHSmith experienced a data breach incident in September 2015 because of a glitch in its IT system. Its website randomly started sending out hundreds of private emails to people on its mailing list which resulted in the leakage of data of about 22 customers. The compromised data included real names, phone numbers, postal addresses, and email addresses of people trying to contact WHSmith. WHSmith immediately took preventive steps and apologized to the impacted persons.