Harrods has announced that some of its customers' personal data may have been compromised in an IT breach linked to one of its third-party providers. The luxury department store disclosed that the data taken included basic personal identifiers such as names and contact details, but did not encompass sensitive information like account passwords or payment details. According to Harrods, the breach was an isolated incident, separate from earlier attempts to infiltrate its own systems earlier this year, and the company is working closely with the third party involved to contain the issue and prevent further risks. Relevant authorities have been informed as part of the response efforts.

This latest breach follows a series of cyber threats targeting major UK retailers throughout 2025. Harrods itself was affected by a cyber-attack in May, during which its IT security team restricted internet access across its premises as a precautionary measure. Despite this disruption, the department store’s physical locations and online shopping services remained operational, with no data believed to have been accessed at that time. Similar cyber-attacks recently hit other prominent retailers including Marks & Spencer and the Co-op, causing significant operational impact, particularly for M&S which saw its online store shuttered for nearly seven weeks.

In a notable development linked to these attacks, UK police arrested four individuals aged between 17 and 20 in July on suspicion of offences encompassing blackmail, money laundering, breaches of the Computer Misuse Act, and participation in organised crime groups. These arrests came following an investigation led by the National Crime Agency and its National Cyber Crime Unit. The suspects are believed to be connected to the spate of cyber-attacks that targeted Harrods alongside Marks & Spencer and the Co-op earlier in the year. Authorities have seized electronic devices to support ongoing inquiries.

Industry experts have noted the growing sophistication and persistence of cyber threats against retail giants, with groups like Scattered Spider suspected of involvement in coordinated attacks across multiple companies. The incidents have raised broader concerns within the UK retail sector about cybersecurity vulnerabilities and the effectiveness of current defence mechanisms in protecting customer data and business continuity.

As Harrods addresses this latest breach, it continues to stress that no internal systems were compromised in the recent incident and reassures customers that it is taking all necessary measures to preserve the security of their information while cooperating fully with authorities and cybersecurity specialists.

📌 Reference Map:

Source: Noah Wire Services