Customers connected to Westfield’s loyalty programme and newsletters have been warned that their personal information may have been accessed in a cyber attack.
The shopping centre operator Unibail-Rodamco-Westfield (URW) has confirmed that a database linked to customer communications was compromised. The incident affects people who signed up to receive marketing emails or who were members of the Westfield loyalty programme.
Westfield operates two of the UK’s largest shopping centres — Westfield Stratford City and Westfield London in White City — which together attract millions of visitors every month.
What information may have been accessed
According to the company, the compromised database may include:
- Names
- Email addresses
- Telephone numbers
- Postcodes
- Dates of birth.
Westfield says no bank details, payment card information or passwords were stored in the affected database and there is currently no evidence that the data has been used fraudulently.
However, the company has warned that affected individuals should remain cautious, as cyber incidents can sometimes lead to follow-up scams.
The company says it took steps to contain the incident and has notified the relevant data protection authorities. If customers have questions about the breach or want to exercise their data protection rights, they can contact Westfield’s data protection officer.
Customers urged to stay alert for phishing attempts
In its notification to customers, Westfield advised people to be wary of any unexpected communications that appear to come from the company.
Cybercriminals sometimes use information obtained in data breaches to send convincing phishing emails or text messages designed to trick people into revealing further personal or financial details.
Customers are being advised to:
- Be cautious of unsolicited calls, emails or texts
- Avoid clicking suspicious links
- Never provide passwords or payment details in response to unexpected messages.
Westfield says it will not ask customers to provide sensitive information through unsolicited communications.
What UK data protection law says about breaches
Under UK data protection law, organisations that suffer a breach involving personal data may be required to report the incident to the Information Commissioner’s Office (ICO) and notify affected individuals if there is a risk to their rights or freedoms.
Companies are expected to take appropriate steps to secure personal data and investigate how the incident occurred.
Staying informed about data breaches
Large retailers and consumer-facing organisations are increasingly becoming targets for cybercriminals.
At Join the Claim, we monitor major consumer issues such as data breaches and explain what they could mean for the public. If a compensation claim is later launched by a regulated UK law firm in relation to a major breach, we aim to explain the process and help people understand whether they may be affected.
Join the Claim is monitoring developments in this case and will provide updates if any legal actions arise with our partner firms.
