Clubcard theft ‘work of cyber gang’

Tesco is blaming a criminal gang for a new spate of thefts of Clubcard points, claiming its systems are safe as houses and that villains have obtained lists of customers’ email addresses and passwords from somewhere else.
The move comes amid fresh reports of the Clubcard points scam – first reported by DecisionMarketing nearly a year ago – despite the retailer conducting a “thorough investigation”, that revealed no weakness nor any sign that its systems were compromised or breached.
The fact that fraud was being perpetrated on a “small proportion” of the 16 million Clubcard accounts was first admitted by Tesco in February 2013, when it called in the police. Tesco says the police investigation is ongoing, although it will not say how many accounts have been hacked.
Since introducing online Clubcard accounts in October 2012, all that was required to log in was an email address and a password. Since October, as an additional protection, Tesco requires account holders to include their Clubcard number.
It is unclear whether accounts are still being attacked, and as many people cash their points in the run-up to Christmas or at only one point in the year, it is possible those who report fraud now may have fallen victim many months ago.
In a written statement, Tesco said: “We are committed to ensuring that none of our customers miss out as a result of this. We remind all of our customers to always use different passwords to be as secure as possible online and to contact our Clubcard customer service team if they have any questions.”

Related stories
Clubcard site hit by new hack attack
Tesco warns of Clubcard theft threat
Clubcard vouchers to go digital