WHSmith breach exposes current and former employee data

WHSmith, a centuries-old British retailer that specializes in books and other publications, has been hit with a cyberattack, with threat actors accessing company data.

The company said it was investigating a breach that led to unauthorized access to company data, including that of existing and former employees, although it is claiming business as usual in spite of the attack.

“We are notifying all affected colleagues and have put measures in place to support them,” WHSmith told Cybernews, adding that upon discovering the breach, it had notified authorities and launched an investigation.

“There has been no impact on the trading activities of the group. Our website, customer accounts and underlying customer databases are on separate systems that are unaffected by this incident,” WHSmith said.

“There has been no impact on the trading activities of the group. Our website, customer accounts and underlying customer databases are on separate systems that are unaffected by this incident.”

WHSmith said.

The company boasts over 12,500 employees, which means the number of people affected by the breach may be even larger.

WHSmith owns close to 600 high street and over 1,100 travel stores worldwide, and its logo is a frequent sight across the world’s airports, especially in Europe. WHSmith was founded in 1792, which means that an organization operational during the French Revolution has experienced a computer-based intrusion.

Richard Hollis, CEO of cybersecurity firm Risk Crew, says that the limited information WHSmith provided about the breach suggested the culprits had obtained names, addresses, dates of birth, and national insurance numbers of staff – although he acknowledged WHSmith’s claims that no trading data had been compromised.

“While it’s reassuring that no financial information has been compromised, this doesn’t make the breach any less severe. People can’t simply move house or change their name after a data breach, so this information is now in the hands of criminals forever. Attackers can use this data to commit identity fraud and also target victims with realist phishing emails in a bid to steal further information,” Hollis said.

British companies are popular targets for cyber-crooks. Last November, Russia-linked cyber syndicate LockBit targeted Royal Mail with a ransomware attack, demanding the organization to cough up $80 million, a demand the firm eventually refused.