Tesco tesco.com Tesco data breach: what happened and what to do
In February 2014, details of 2,239 Tesco accounts, including email addresses, plain text passwords and Clubcard point balances, were posted online. Tesco said the list did not come from its own systems. If you used the same password elsewhere, change it there too.
View all 13,115 breaches- Breach date
- 12 Feb 2014
- Affected
- 2,239
- Data exposed
- Email addresses, Passwords, Reward program balances
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In February 2014, a list of Tesco account details appeared on a public text-sharing site. Have I Been Pwned counts 2,239 accounts in the list. Each entry had an email address, a password and a Clubcard points balance.
Have I Been Pwned says the source of the data isn't clear. Press reports at the time quoted Tesco saying the details did not come from its own website, and that hackers had probably collected them from other breaches. Tesco deactivated the affected accounts and contacted the customers involved, according to those reports.
What was exposed
Email addresses, passwords and Clubcard balances. The passwords were in plain text, so anyone who saw the list could read them. No payment card numbers are listed in the entry.
The main risk is password reuse. If the Tesco password also worked on your email, a shopping site or a bank login, a criminal can try it there. Email addresses on the list also make you a target for phishing that mentions Tesco or Clubcard points.
What Tesco did
Tesco disabled the accounts on the list and told customers it had contacted those affected. The breach is small next to most others, and it dates from 2014, but the lesson holds: a leaked password is only dangerous where you've reused it.
What to do if you were in it
- 1
Change the password everywhere you reused it
If you ever used your Tesco password on another site, change it on that site now. Use a different password for each account, ideally from a password manager.
- 2
Turn on two-factor login
Switch on two-factor authentication for your email and any account that holds money or personal details. A leaked password then isn't enough to get in.
- 3
Expect phishing that mentions Tesco
Be wary of emails or texts about Clubcard points, vouchers or account problems. Go to the Tesco site or app yourself instead of clicking a link.
- 4
Check whether your email or phone is in this and other breaches
Serus runs a free scan that checks breach databases for your email address and phone number, and alerts you if they show up. It can't take data out of a breach, but it tells you what to change.
Frequently asked
Was I affected by the Tesco breach?
Only 2,239 accounts were on the list. You can check your email address on Have I Been Pwned, or run a free Serus scan.
What was exposed in the Tesco breach?
Email addresses, passwords and Clubcard point balances.
Did the data come from Tesco's own systems?
Tesco said it did not, according to press reports. Have I Been Pwned says the source isn't clear.
Should I change my password?
Yes, if you used your Tesco password anywhere else. Change it on those sites and use a unique one for each.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
