Feeds

THOUSANDS of Tesco.com logins and passwords leaked online

Customers locked out of accounts, some discount vouchers AWOL

Protecting against web application threats using SSL

Thousands of Tesco customers have had their emails and passwords posted online after hackers got their hands on the login details.

A list of over 2,200 Tesco.com accounts was published on Pastebin yesterday and some customers have complained that their vouchers have gone missing from their accounts.

Tesco customers took to the supermarket giant's Facebook page to report being booted out of their accounts and having their points and vouchers stolen.

The grocery chain said that it was "urgently investigating" the situation.

"We have contacted all customers who may have been affected and are committed to ensuring that none of them miss out as a result of this," Tesco said in a statement.

"We will issue replacement vouchers to the very small number who are affected."

Post on Tesco Facebook page about account hack

Nicked: Customers took to Facebook to complain about missing discount vouchers

It's believed that the usernames and passwords were acquired from hacks on other sites and then tried out on Tesco.com by the hackers.

Trey Ford, global security strategist at Rapid7, said that the breach highlighted again the danger of reusing passwords across multiple accounts.

"The attackers seem to have picked up usernames and passwords that were leaked after breaches of other, potentially unrelated organisations, and by trying them on Tesco’s site, they were able to compromise 2,239 Tesco.com customer accounts," he said.

"So far the information available indicates that the impact of this has been relatively limited – stolen vouchers – but if attackers have tried this on Tesco.com, the chances are they are also trying it on other sites too and so we may see additional fallout."

February seems to be a bad month for Tesco customers - in the same month last year the supermarket chain had to call in the cops after hackers stole Clubcard vouchers from customers' online accounts.

The company also had a bit of a security gaffe earlier this week when it sent out an email to hundreds of customers about a pricing error on a trampoline and revealed all their email addresses. Tesco sent out the missive to tell customers they wouldn't be getting the trampoline they ordered because it had been priced incorrectly.

One customer said on Facebook:

Would love to know how the 'investigation' over the fact that emails were sent out cancelling the trampoline purchases last night sending the email to around 300 people at a time... showing ALL the personal emails of recipients! Total lack of protection for customers details!

I personally received FIVE messages so I have on my emails approx. 1500 emails!!

Would appreciate a response, as when I complained over the phone last night I was told they would be in touch... how I wonder? I do hope not via email!!

®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.