Tesco has confirmed that it has called in the police to investigate a possible data breach after a number of complaints from Clubcard members who claim to have had their online accounts compromised.
Clubcard holders informed moneysavingexpert.com that they have found hundreds of pounds worth of vouchers missing from their accounts, with vouchers being spent miles away from where they live, as well as some claiming that their account details have been changed.
Tesco told Computerworld UK that the number of compromised accounts is less than 100 and it is working with the relevant authorities to resolve the issue. The retail giant has 16 million Clubcard members.
"We have launched a thorough investigation into a small number of incidents and referred the matter to the police," said a spokesperson for Tesco.
"In the meantime, we'd like to ask any customers who believe they're affected to contact us directly so that we can make sure their accounts are up to date."
This isn't the first time Tesco's security practices have been brought into question. In August last year the UK's Information Commissioner's Office confirmed that it was 'making enquiries' intoa number of security concerns that had been raised regarding Tesco's customer facing website.
Security researcher Troy Hunt detailed in a blog that he had received a password reminder in an email from Tesco that contained his password in plain text.
Hunt wrote: "Righto, so how exactly was that password protected in email? Well, of course it wasn't protected at all, it was just sent off willy nilly."
Hunt was prompted by his experience to investigate additional security aspects of Tesco's website.
One thing he identified was that although users log into the Tesco website over HTTPS, which "implies a degree of security", the browser reverted back to HTTP, which does not give users security assurances. Hunt said that this can cause problems for data protection and make users vulnerable to hacking.