THOUSANDS of Tesco.com logins and passwords leaked online

Customers locked out of accounts, some discount vouchers AWOL


Thousands of Tesco customers have had their emails and passwords posted online after hackers got their hands on the login details.

A list of over 2,200 Tesco.com accounts was published on Pastebin yesterday and some customers have complained that their vouchers have gone missing from their accounts.

Tesco customers took to the supermarket giant's Facebook page to report being booted out of their accounts and having their points and vouchers stolen.

The grocery chain said that it was "urgently investigating" the situation.

"We have contacted all customers who may have been affected and are committed to ensuring that none of them miss out as a result of this," Tesco said in a statement.

"We will issue replacement vouchers to the very small number who are affected."

Post on Tesco Facebook page about account hack

Nicked: Customers took to Facebook to complain about missing discount vouchers

It's believed that the usernames and passwords were acquired from hacks on other sites and then tried out on Tesco.com by the hackers.

Trey Ford, global security strategist at Rapid7, said that the breach highlighted again the danger of reusing passwords across multiple accounts.

"The attackers seem to have picked up usernames and passwords that were leaked after breaches of other, potentially unrelated organisations, and by trying them on Tesco’s site, they were able to compromise 2,239 Tesco.com customer accounts," he said.

"So far the information available indicates that the impact of this has been relatively limited – stolen vouchers – but if attackers have tried this on Tesco.com, the chances are they are also trying it on other sites too and so we may see additional fallout."

February seems to be a bad month for Tesco customers - in the same month last year the supermarket chain had to call in the cops after hackers stole Clubcard vouchers from customers' online accounts.

The company also had a bit of a security gaffe earlier this week when it sent out an email to hundreds of customers about a pricing error on a trampoline and revealed all their email addresses. Tesco sent out the missive to tell customers they wouldn't be getting the trampoline they ordered because it had been priced incorrectly.

One customer said on Facebook:

Would love to know how the 'investigation' over the fact that emails were sent out cancelling the trampoline purchases last night sending the email to around 300 people at a time... showing ALL the personal emails of recipients! Total lack of protection for customers details!

I personally received FIVE messages so I have on my emails approx. 1500 emails!!

Would appreciate a response, as when I complained over the phone last night I was told they would be in touch... how I wonder? I do hope not via email!!

®

Similar topics


Other stories you might like

  • It's 2022 and there are still malware-laden PDFs in emails exploiting bugs from 2017
    Crafty file names, encrypted malicious code, Office flaws – ah, it's like the Before Times

    HP's cybersecurity folks have uncovered an email campaign that ticks all the boxes: messages with a PDF attached that embeds a Word document that upon opening infects the victim's Windows PC with malware by exploiting a four-year-old code-execution vulnerability in Microsoft Office.

    Booby-trapping a PDF with a malicious Word document goes against the norm of the past 10 years, according to the HP Wolf Security researchers. For a decade, miscreants have preferred Office file formats, such as Word and Excel, to deliver malicious code rather than PDFs, as users are more used to getting and opening .docx and .xlsx files. About 45 percent of malware stopped by HP's threat intelligence team in the first quarter of the year leveraged Office formats.

    "The reasons are clear: users are familiar with these file types, the applications used to open them are ubiquitous, and they are suited to social engineering lures," Patrick Schläpfer, malware analyst at HP, explained in a write-up, adding that in this latest campaign, "the malware arrived in a PDF document – a format attackers less commonly use to infect PCs."

    Continue reading
  • New audio server Pipewire coming to next version of Ubuntu
    What does that mean? Better latency and a replacement for PulseAudio

    The next release of Ubuntu, version 22.10 and codenamed Kinetic Kudu, will switch audio servers to the relatively new PipeWire.

    Don't panic. As J M Barrie said: "All of this has happened before, and it will all happen again." Fedora switched to PipeWire in version 34, over a year ago now. Users who aren't pro-level creators or editors of sound and music on Ubuntu may not notice the planned change.

    Currently, most editions of Ubuntu use the PulseAudio server, which it adopted in version 8.04 Hardy Heron, the company's second LTS release. (The Ubuntu Studio edition uses JACK instead.) Fedora 8 also switched to PulseAudio. Before PulseAudio became the standard, many distros used ESD, the Enlightened Sound Daemon, which came out of the Enlightenment project, best known for its desktop.

    Continue reading
  • VMware claims 'bare-metal' performance from virtualized Nvidia GPUs
    Is... is that why Broadcom wants to buy it?

    The future of high-performance computing will be virtualized, VMware's Uday Kurkure has told The Register.

    Kurkure, the lead engineer for VMware's performance engineering team, has spent the past five years working on ways to virtualize machine-learning workloads running on accelerators. Earlier this month his team reported "near or better than bare-metal performance" for Bidirectional Encoder Representations from Transformers (BERT) and Mask R-CNN — two popular machine-learning workloads — running on virtualized GPUs (vGPU) connected using Nvidia's NVLink interconnect.

    NVLink enables compute and memory resources to be shared across up to four GPUs over a high-bandwidth mesh fabric operating at 6.25GB/s per lane compared to PCIe 4.0's 2.5GB/s. The interconnect enabled Kurkure's team to pool 160GB of GPU memory from the Dell PowerEdge system's four 40GB Nvidia A100 SXM GPUs.

    Continue reading

Biting the hand that feeds IT © 1998–2022