WH Smith Hit by Cyber Attack with Hackers Accessing Data on Employees

Retailer WH Smith has been targeted by a cyber attack, with hackers accessing data on current and former employees. The company said it had taken immediate action to secure its systems and launch an investigation into the incident.

The company, which operates over 1,200 stores in 30 countries, said it had notified the Information Commissioner's Office (ICO) and was working with law enforcement agencies to identify those responsible. WH Smith said it had also contacted affected employees to advise them on how to protect their personal information.

The data breach is the latest in a series of high-profile cyber attacks that have hit UK businesses and organisations in recent months, with JD Sports and Royal Mail being hit. Experts say cyber criminals are increasingly targeting companies with valuable data, such as financial information or customer data, in order to sell it on the black market or use it for fraud.

Former and Present Employee Data Hacked, but No Customer Data

According to WH Smith, the hackers accessed personal information, names, addresses, dates of birth and national insurance numbers, though it does not believe banking details have been accessed. The company said it did not believe any customer data had been affected.

In a statement, WH Smith said: "We are taking this incident extremely seriously and have taken immediate steps to secure our systems and investigate the incident. We are sorry for the concern and inconvenience this may have caused our employees and are working hard to provide them with support and advice."

The company added that it had engaged cyber security experts to conduct a thorough investigation and strengthen its security systems. It also said it had reviewed its policies and procedures for handling personal data and was taking steps to ensure they are aligned with best practice and legal requirements.

The ICO said it was aware of the data breach at WH Smith and was making inquiries. "Businesses and organisations have a legal duty to keep personal information secure," a spokesperson said. "We will be working with WH Smith to establish the full facts and ensure that appropriate action is taken to protect people's personal data."

According to the Cyber Security Breaches Survey 2022, published by the UK government, 39% of UK businesses experienced at least one cyber security breach in the previous 12 months. The survey also found that the average cost of a cyber attack for a large business was £19,400, while for a small business it was £4,200.

The cyber attack on WH Smith highlights the ongoing threat posed by cyber crime to  businesses and organisations across the globe.