Tesco Clubcard holders: Consider changing passwords after breach

The supermarket giant, which has 16 million Clubcard users, has confirmed that email addresses and passwords used to log on to Tesco Clubcard and access Clubcard vouchers, were posted on the internet yesterday. (See our Tesco Clubcard guide for more on using the cards.)

Tesco says a "handful" of accounts were "compromised". Tesco won't elaborate on what exactly "compromised" means, but it appears some may have had Clubcard vouchers stolen from their accounts. Any stolen Clubcard vouchers will be reissued, the firm says.

It believes the fraudsters who published the list used information from other website hacks to gain email addresses and passwords.

Hackers then used this information to uncover Clubcard login details where consumers had used the same email addresses and passwords for different online accounts.

A year ago, Tesco asked police to probe a breach after MoneySavingExpert.com revealed Clubcard vouchers had been stolen from numerous online accounts and spent, sometimes miles away from the user's home.

At the time, the supermarket said fraudsters accessed Clubcard accounts using the correct username and password, most probably sourced from elsewhere online.

We still receive numerous reports from users about Clubcard vouchers being used fraudulently. Tesco told us earlier this month that the police investigation into this issue is still ongoing.

I'm a Tesco Clubcard holder. What should I do?

Tesco says it has disabled the affected accounts, adding it has contacted customers to let them know how to change their passwords.

But even if you've not been affected, it's worth considering changing your password, as we still receive reports from users about Clubcard vouchers being used fraudulently, and you should always try and change passwords regularly anyway.

MoneySavingExpert.com managing editor Guy Anker says: "All Clubcard users should consider changing their password, not only on their Clubcard account, but on all other online accounts. Also check the rest of your Clubcard account details are correct.

"Everyone should try to change passwords regularly, and ensure they are complex enough so they're difficult to guess. It's also wise to use different passwords for different accounts."

To change your password, login to your Clubcard account using your email address and password. Click on 'My Personal Details' on the left handside and enter the three required digits from your Clubcard number when prompted. When the next page appears, select 'Change your Tesco password'.

If you've been a victim of fraud, you can also report the issue to Action Fraud.

My Clubcard vouchers were stolen. Will I get them back?

Tesco says it will reissue any Clubcard vouchers stolen.

If you think you're affected and you haven't heard from Tesco, you can contact it via its customer services.

What does Tesco say?

A spokesman for Tesco says: "We take the security of our customers' data extremely seriously and are urgently investigating these claims. We have contacted all customers who may have been affected and are committed to ensuring that none of them miss out as a result of this.

"We will issue replacement vouchers to the very small number who are affected."