Clothes retailer Fatface: Someone's broken in and accessed your personal data, including partial card payment details... Don't tell anyone

Updated British clothes retailer Fatface has infuriated some customers by telling them "an unauthorised third party" gained access to systems holding their data earlier this year, and then asking them to keep news of the blunder to themselves.

Several people wrote into The Register to let us know about the personal data leak, with reader Terry saying: "You will notice the Fatface email is marked as confidential. This annoyed me."

Chief exec Liz Evans wrote in an email titled "Strictly private and confidential – Notice of security incident" sent to users yesterday:

Quite reasonably, customers quickly took to social media to ask where they could find "a public statement on your data breach," why it had waited so long to inform customers, why the mail was marked "confidential" and whether it was genuine. All were directed to kindly "DM" the firm's social media handler.

It also noted that it would be giving recipients "access to a complimentary Experian Identity Plus membership... purely out of an abundance of caution and not because we consider your data specifically to be at risk."

It did not detail how many people had been affected. The firm has "200 stores across the UK and Ireland" – doing particularly well in seaside areas – and offers international shipping, although its website currently says this is unavailable.

According to its most recent financials filed at Companies House, full accounts for the 52 weeks up to 30 May 2020 [PDF], the Group's revenue dropped to £198.2m from £236.4m in 2019, but noted that its online business had "doubled in the last five years."

Fatface obtained refinancing last year to reduce its debts and said it had "seen the benefits of the staycation trend in our local market towns and holiday destination stores."

Also in the document, the org said it had firewalls in place and that it made "regular checks... on the security of our systems" and was "implementing Multi-Factor authentication (MFA)," which would be in place by 2020/21.

It also said: "We have commenced a programme of work to upgrade some of our older applications with a modern, cloud-based application with Phase 1 completed and a further phase scheduled for 2021," adding that the "Group has also commenced a core system replacement project which will happen over the next 2 years. Phase 1 has been approved and delivery is underway."

We have asked Fatface how far along it is with this project. We also asked about the extent of the breach as well as its decision to ask customers whose data had potentially been accessed to keep their mouths shut about it.

Ironically, Fatface itself also noted in the financial results document that any "failure to react appropriately in the event of breach... could result in financial penalties or reputational damage."

Neil Brown, a tech-savvy lawyer who runs decoded.legal, told us: "An organisation, which may have failed to keep its customers’ information private, asking those very customers to keep Fatface’s information private? The irony.

"It’s not something I have seen before, and it’s unlikely to enamour Fatface to those whose information has been — or may have been — compromised."

UK data watchdog the Information Commissioner's Office (ICO) told The Register: "People have the right to expect that organisations will handle their personal information securely and responsibly.

"When a data incident happens, we would expect an organisation to consider whether it is appropriate to contact those affected, and to consider whether there are steps that can be taken to protect them from any potential adverse effects.

"Fatface has made us aware of an incident and we are making enquiries." ®

Updated to add

French publication LeMagIT reports that FatFace paid a $2m ransom, negotiated down from about $8m, to the Conti ransomware gang, which broke into the retailer's network in January, siphoned 200GB, and scrambled its files.