Personal details of up to 2.4 million Carphone Warehouse customers may have been accessed in a cyber-attack, the mobile phone retailer says.
Up to 90,000 customers may also have had their encrypted credit card details accessed, it said in a statement.
The affected area operates the OneStopPhoneShop.com, e2save.com and Mobiles.co.uk websites.
It also provides services to iD Mobile, TalkTalk Mobile, Talk Mobile and some Carphone Warehouse customers.
Sebastian James, chief executive of the retailer’s owner, Dixons Carphone, said he was “very sorry” over the attack.
“We are, of course, informing anyone that may have been affected, and have put in place additional security measures,” the chief executive said.
“We take the security of customer data extremely seriously, and we are very sorry that people have been affected by this attack on our systems.”
The company’s investigation found that the data could have included names, addresses, dates of birth and bank details.
The BBC’s Joe Lynam says Carphone Warehouse first became aware of the problem on 5 August.
What can those affected do?
- Notify your bank and credit card company, so they can monitor activity on your account
- Change your password for your online account
- Check your account for any suspicious or unexpected activity
- Be wary of anyone calling asking for personal information, bank details or passwords
- Visit Experian or Equifax to check your credit rating to make sure no one has applied for credit in your name
Those who think they have been the victim of fraud should contact Action Fraud on 0300 123 2040.
“In that time, 72 hours, they will say we need to find the depth of the breach, but let’s say some people do have their cards compromised,” he said.
“They will be livid that they weren’t told straight away, so they could cancel those cards.”
Dixons Carphone was formed last year by the merger of Carphone Warehouse and Dixons Retail.
In July it reported a 21% jump in profits in its first annual results since the merger that created the mobile phone and electrical goods firm.
In the UK and Ireland, where it trades under the Carphone Warehouse, Currys and PC World names, sales rose by 8%.
Carphone Warehouse said it was informing all customers who may have been affected of the breach.
It will also advise affected individuals on how to reduce the risk of further consequences arising from the data leak.
Customer information for Currys and PC World – and the “vast majority” of Carphone Warehouse – is held on separate systems and was not accessed during the attack, the company added.
