The Harrods data breach that surfaced in September 2025 is worth studying for one reason most news coverage skipped: Harrods' own network was not the way in. According to the retailer's own statement, around 430,000 customer records were taken through a third-party provider, and passwords and payment details were not affected. Earlier in the year, in spring 2025, Harrods said it had contained an attempted intrusion during the wider wave of attacks on UK retailers. Two incidents, one year, and in the September case the data sat with a supplier.
If your customer contact data lives with an email service provider, a loyalty vendor or an agency-run campaign platform, the same shape of incident is available to you. Here are six supplier-side lessons, each paired with the detection work that would surface the risk in your own estate.
The reported facts are narrow but useful. In September 2025 Harrods disclosed that customer records held by a third-party provider had been accessed, affecting roughly 430,000 people. The exposed fields were reported as names, contact details and marketing preferences. Harrods stated that passwords and payment information were not involved. Hackers then contacted the retailer directly in an extortion attempt, and arrests have been reported in connection with the 2025 attacks on UK retailers, with suspects held under the Computer Misuse Act.
"No payment data"is the least useful reassurance in breach communications. A card number gets reissued in a week. A name, mobile number, email address and a marketing preference set does not expire, and it is exactly the input an attacker needs to sound legitimate on an account-recovery call or to write a refund email the recipient believes. Treat contact data as long-lived attack material, because that is how the buyers treat it.
One phrase to distrust in any supplier notification: "isolated incident". Marketing and loyalty platforms are multi-tenant by design. When a shared platform is compromised, the realistic assumption is that other brands on the same platform are in scope until the supplier demonstrates otherwise, with evidence rather than adjectives.
Consumer data leaves the corporate perimeter for entirely ordinary reasons. A typical mid-size retail estate looks something like this: one e-commerce platform, an email service provider, a loyalty vendor, two agency-run campaign subdomains and a clienteling app used by store staff. That is already five parties able to read customer contact data, before you count sub-processors.
Marketing is where shadow IT concentrates. Campaign tools bought on a corporate card, a landing page builder trialled for one launch, a survey platform that quietly retained 40,000 email addresses. Never onboarded through security, never offboarded, still holding data three years later.
Build a data-location register and keep it short enough that people actually maintain it. Four columns do most of the work: supplier name, data categories held, internal contract owner, and the named contact for breach notification with an out-of-hours route. Then ask every vendor the question that gets skipped: which of your sub-processors can read our customer records, and where are they hosted?
Most organisations cannot answer "which suppliers hold our customer records"within a day. External discovery helps, because supplier relationships leave DNS fingerprints. A CNAME pointing at a marketing automation platform, a vendor-hosted portal on a subdomain carrying your brand, an agency microsite with your logo and a contact form feeding somewhere you have never audited.
That is the attacker's starting view too. Continuous external asset discovery across your domains, subdomains and public-facing infrastructure gives you a supplier map derived from what actually resolves on the internet, rather than from what procurement remembers signing. Cross-reference that list against your register. The gaps are the interesting part.
Legacy campaign sites, staging environments and old loyalty portals have a habit of still resolving years later, often unpatched and still connected to a data store. Ownership and hosting views matter here: an asset in a cloud region your business does not use, or registered to an agency that stopped working with you in 2022, is a strong signal that something has fallen outside management.
Cadence beats depth. An annual attack surface review tells you what was true last January. Ongoing monitoring of changes across your external estate turns this into a weekly fifteen-minute question: what appeared, what changed, what now has a login page on it? New assets are where new exposure arrives, and they arrive between audits.
The reported entry route across the 2025 UK retail incidents, including those affecting M&S and Co-op, was social engineering of support and identity processes rather than zero-day exploits. Helpdesk password resets, MFA fatigue prompts and SIM-linked account recovery. Attackers talked their way in.
Rewrite your supplier due diligence questionnaire accordingly. Asking whether a vendor holds ISO 27001 is table stakes and, on its own, a trap: a certificate can cover a head-office function while the platform actually holding your customer records sits outside the scope statement. Always request the scope statement, not just the certificate number. Then ask the question that maps to the real attack: how do you verify a caller before resetting an administrator password, and who signs off on MFA re-enrolment?
Three controls are worth insisting on for any vendor with admin access to your customer data: a scripted identity verification process for helpdesk resets that does not rely on knowledge an attacker can buy, phishing-resistant MFA (FIDO2 or platform passkeys) on all admin accounts, and a documented escalation path for out-of-pattern recovery requests.
Corporate credentials belonging to supplier staff show up in stealer logs constantly, harvested from personal machines that also held a work session. A leaked password is a problem. A leaked session cookie is worse, because it can sidestep MFA entirely until the session is invalidated, and most organisations have no process for forcing that at a third party.
Executive and VIP detail feeds the same attack. Personal email addresses, home locations and social media breadcrumbs are what make a reset call sound plausible to a helpdesk agent under pressure. We cover this in more detail in our guide to who to include in VIP monitoring and the mistakes that leave executives exposed. Per-person risk scoring for high-privilege staff is a reasonable way to prioritise: the CFO, the head of CRM and the two agency admins with production access deserve more attention than a generic all-staff awareness module.
Extortion crews increasingly publish and negotiate through Telegram channels rather than classic forums. A brand watchlist covering only onion leak sites will find out late, because sample data and bragging often appear in Telegram chatter days before anything is formally listed. Monitoring Telegram alongside dark web marketplaces and leak sites is now part of the baseline, not an optional extra.
Watch for your brand name, your domains, your executives' names, and structured samples that look like your customer schema. Continuous OSINT and dark web monitoring for brand and credential exposure exists for exactly this window, the gap between an attacker having your data and your supplier admitting it.
Then verify before you confirm anything. Attackers routinely pad a sample with recycled records from older breaches to inflate the claimed volume. Matching the sample against your own records tells you three things a press release cannot: whose system was actually hit, whether the record count is real, and which data categories are genuinely in play. Confirming a breach on the attacker's evidence alone is how organisations end up notifying on numbers that turn out to be wrong.
The fraud arrives faster than the notification. Lookalike domains and refund-themed phishing targeting affected customers typically appear while the brand is still drafting its email. "Verify your account", "your loyalty points have been suspended", an SMS with a shortened link. The attackers have the contact details and the news cycle, and both work in their favour.
Domain detection and takedown capability needs to exist before the incident, not be procured during it. Practically, that means registrar and hosting abuse contacts already identified, an evidence pack template (screenshots, WHOIS, hosting records, timestamps) ready to fill in, and a decision already made about who authorises a takedown request at 9pm on a Friday.
On extortion: decide in advance who talks and who does not. Legal counsel and a nominated incident lead only, with everyone else routed to them. Paying rarely removes data from resale, because the same records get brokered onward regardless of any promise made in a chat window. Budget your effort for customer protection and detection instead.
Four weeks is enough to move from assumption to evidence.
Contractually, hold suppliers to a breach notification window measured in hours rather than "without undue delay", annual evidence of MFA on administrative access, sub-processor disclosure with change notification, and accreditation tracking that includes the scope statement. Renegotiate at renewal if you have to.
Do not lose sight of who carries the regulatory weight. Under UK GDPR Article 33, the controller has 72 hours from becoming aware of a personal data breach to notify the ICO, and the ICO's guidance on personal data breach reporting makes clear that a processor must tell the controller without undue delay. If the data is yours, the clock starts when you learn of it, not when your supplier finishes investigating.
For the board, keep the reporting to three lines: current external exposure count and what it consists of, what changed this week, and the residual risk you have consciously accepted. That last line is the one that earns credibility.
In its September 2025 disclosure, Harrods said customer records were taken from a third-party provider, comprising basic personal details such as names, contact information and marketing preferences. Harrods stated that passwords and payment details were not affected. That still leaves enough information for targeted phishing and account-recovery fraud.
Harrods reported two separate events in 2025. In the spring it said it had detected and contained an attempted intrusion during the wider wave of attacks on UK retailers. The September disclosure was a different matter, involving customer data held by a third-party provider rather than Harrods' own systems.
Affected individuals should be contacted directly by the retailer, so treat the official statements and any email sent from a verified Harrods domain as your source. Do not click links in unsolicited messages referencing the incident, and never respond to a "verify your account"request tied to a breach. Type the retailer's address into your browser yourself.
The data controller remains accountable to the ICO and to data subjects, even where the compromised system belongs to a processor. Article 33 gives the controller 72 hours from becoming aware to notify the regulator where the breach is likely to result in a risk to individuals. Processor contracts should require immediate notification so that clock is not consumed by someone else's internal review.
Through outside-in visibility rather than vendor assurances. Continuous monitoring of dark web marketplaces, leak sites and extortion Telegram channels for your brand name and customer data samples often surfaces evidence days before a formal disclosure, and external asset discovery shows which supplier platforms are exposed in your name in the first place. If you want to see what that looks like against your own estate, sign up for a free DarkInvader account or speak to the team.
The lasting lesson from the Harrods data breach is a straightforward one: your external attack surface includes every supplier holding your customer data, and the first sign of trouble is rarely an alert from your own SIEM. Map the footprint, watch the identity paths into it, and monitor the places stolen data appears, before an extortion email tells you what you should already have known.
Unlock full visibility of your external attack surface with DarkInvader’s continuous, real-time monitoring. Create your free account to discover unknown assets, detect emerging risks and stay ahead of potential threats before attackers can exploit them.
Create My Free Account
Platform 7D, New Station Street, Leeds,
LS1 4BT, United Kingdom
Mon-Fri, 9:00-17:00
Contact:
sales@darkinvader.io
+44 (0)1138805336
Last updated: 14 August 2026
©2026 DarkInvader, All Rights Reserved
