WHSmith 'data breach': Dozens of customers' private details sent to others via mass emails

The retailer has apologised amid a growing number of online complaints

Click to follow
The Independent Online

A glitch in the IT system for WHSmith's subscriptions service has seen dozens of people's personal data distributed to other customers via email.

Users reported what one called a "huge breach of data protection" on Wednesday morning, involving the company's magazine subscription service.

Customers who had used the related "Contact Us" form said they started receiving spam that included other people's phone numbers, names and email addresses.

The company confirmed to The Independent that there has been an issue with its subscription service, which it described as "a bug, not a data breach", and which led to customers "receiving emails this morning that have been misdirected in error".

Dozens of users complained on the retailer's Facebook page. User Steph Armitt said she had received "65 emails starting at 00.12 this morning". Yasmin Schulze said she had "over 20 emails so far from your contact us forms with customers emails and phone numbers". She added that it was "not only a privacy issue but also highly annoying".

Many complained about the lack of a response from the company - and one, Claire Brown, even suggested that her first post complaining of the issue "has been deleted".

On Twitter, Jono Read wrote that it appeared "every time someone emails WHSmith about magazine subscriptions it's going to everyone on the database, details too".

Another user, Lynn Schreiber, posted screenshots of the problem and said she was getting "dozens of emails".

This morning I have recived three emails from customers using your online "contact us" user forms. It has their contact...

Posted by Bea Ossei on Tuesday, 1 September 2015

She said some users were exacerbating the problem by reporting it via the "contact us" form, and seeing those emails also forwarded to "random folk".

In one message, a user named Charlie appeared to have realised this, and sent a "shout-out to my awesome husband and daughter".

WHSmith said that the "Contact Us" page where the bug occurred had been taken down, and apologised to the customers concerned.

A spokesperson said the company "believe[s] the issue has impacted fewer than 40 customers", despite the large numbers complaining online. A greater number of users were believed to be on the receiving end of the spam emails.

A statement read: "I-subscribe (who manage WHSmith's magazine subscriptions) are contacting the customers concerned to apologise for this administrative processing error. We can confirm that this issue has not impacted or compromised any customer passwords or payment details."