Hackers steal bank card details of SIX MILLION Dixons Carphone customers after being inside the firm's computer systems unnoticed for almost a YEAR

• e-mail

One of the worst British cyber attacks was only discovered after the hackers had been inside the system for almost a year.

Unbeknown to electronics giant Dixons Carphone, hackers were able to steal the bank details of 5.9million payment cards and the personal data records of a further 1.2million.   

The major data breach involved shoppers at Currys PC World and Dixons Travel but bosses insist there is no sign of any related fraud.

Access was also gained to non-financial personal data, such as addresses, names and email information.

It comes just months after the company was fined £400,000 for a 2015 cyber attack which exposed the personal data of more than three million customers. 

Retailer Dixons Carphone has become the latest victim of a cyber attack after revealing 5.9 million customer bank card details and 1.2 million personal data records were hacked

The retailer said there was a likely attempt to compromise millions of cards in a processing system for Currys PC World and Dixons Travel stores.   

The retailer said 5.9million of the payment cards targeted were protected by chip and Pin, but that around 105,000 non-EU cards without chip and Pin protection were compromised. 

The company is urging customers to take protective measures, but said there is no evidence of fraud on the cards at this stage. 

It said the data accessed did not contain Pin codes, card verification values (CVV) or any authentication data allowing cardholder identification or a purchase to be made.

The group added it did not believe the personal data accessed had left the group's systems.

The hack could lead to the company becoming the latest to be fined by the information commissioner, after Yahoo were fined £250,000 over a breach involving 500,000 UK customers and TalkTalk were hit with a £400,000 after 150,000 customers' details were accessed.

Dixons Carphone chief executive Alex Baldock said: 'We are extremely disappointed and sorry for any upset this may cause.

'The protection of our data has to be at the heart of our business, and we've fallen short here.

'We've taken action to close off this unauthorised access and though we have currently no evidence of fraud as a result of these incidents, we are taking this extremely seriously.'

He told the Daily Mail: 'One of the early things I did is ... launch a review of our systems and our data. 

'As part of that review we determined that this breach had occurred. 

'Even though the breach itself dates back to July last year we have got clarity on it in the past week.’

‘We are coming out early, very early, in the process.’

Mr Baldock described the hack as ‘a sophisticated attack’ using ‘advanced malware’. In a grovelling apology, he said: ‘It is extraordinarily disappointing and I am extremely sorry and I am unhappy we let ... our customers down.’ 

The scandal comes after Carphone Warehouse, now owned by Dixons Carphone, was fined £400,000 by the ICO in January following a hack hitting more than three million customers in 2015.

For the past 11 months, hackers have been able to access personal data, including addresses and phone numbers. Dixons said the hack occurred in one of the processing systems of Currys PC World and Dixons Travel stores.

The breach included details of 5.9 million payment cards and 1.2 million personal data records 

Simon McCalla, of Nominet, which is responsible for the security of UK domain names, said the timing of the breach is all the worse considering the recently brought in rules on data protection.

He said:  'It's also alarming to see how long it took the company to respond to the breach, which allegedly began in July last year. 

'As we're now nearly a year on, something clearly went wrong. With GDPR now in place, businesses need to tighten up their processes and ensure they have a plan in place to prevent these breaches, or risk paying a huge penalty.

'The company doesn't believe any customer data left its systems, but at this stage they can't be sure, especially as over 100,000 non-EU cards have been compromised.' 

The Information Commissioner's Office is investigating and urged anyone who feared they were a victim of fraud to follow the advice of Action Fraud. 

It is understood the breach took place before new rules on data protection were introduced in May, meaning the company would not have had to notify authorities within 72 hours.

Dixons Carphone says it will write to affected to customers and give them advice

However, lawyer Edward Parkes, from law firm Harcus Sinclair, said customers could still be entitled to compensation.

He said: 'If the breach is Dixons' fault, customers will inevitably want to be compensated for any damages and distress caused as a result of hackers being in possession of their financial data. 

'The sum will not be large, somewhere in the range of £1,000 to £5,000, and possibly even higher if a customer's identity was stolen as a result.'

He warned that hackers cold now send out emails posing as Dixons, a practice known as 'phishing'. 

Dixons breach is latest in a series of hacking attacks on British firms

News of the Dixons hack comes the day after Yahoo's British arm was fined £250,000 for taking two years to tell half a million users that their personal information had been harvested by hackers.

Globally the personal data of 500million international customers was taken, including more than 515,000 in Britain during the breach in 2014.

But it took the web giant two years to publicly admit this - meaning that users of the popular email service were in the dark for years.

Last night, the Information Commissioner's Office (ICO) accused the company of failing to take 'technical and organisational measures' to protect the data of 515,121 customers.

Hackers have repeatedly targeted British companies to access customers' data

It emerged last year that around 400,000 people in the UK may have had their information stolen following a cybersecurity breach at the credit monitoring firm Equifax.

The US company said an investigation had revealed that a file containing UK consumer information 'may potentially have been accessed'.

The data included names, dates of birth, email addresses and telephone numbers, but not not addresses, passwords or financial information, the company said.

In 2016, TalkTalk was hit with a record £400,000 fine for the security failings that led to the company being hacked in October 2015.

The Information Commissioner's Office said the attack 'could have been prevented if TalkTalk had taken basic steps to protect customers' information'.

More than 150,000 people of the internet service provider had personal information access, including sensitive financial data of more than 15,000 customers.