Overview

• Harrods began notifying affected e-commerce customers on September 26 after a third-party provider disclosed a compromise.
• The company says its own systems were not accessed and it declined to identify the vendor involved.
• Exposed fields include names, contact information and certain marketing labels such as membership tier or co-branded card affiliation.
• Harrods says it received messages from the threat actor and will not engage, and it has informed relevant authorities.
• The company says this incident is separate from access attempts reported earlier in 2025, while the supplier has told Harrods the breach was isolated and contained.