Tesco

The Tesco data breach occurred in 2014, resulting in the leak of 2,239 customer records. The compromised data included customer email addresses, passwords, and balances from Tescos loyalty reward program.

The breach was reportedly due to a vulnerability in the websites cross-site scripting (XSS) functionality. XSS allows an attacker to inject malicious code onto a website, which can then be used to steal sensitive information. In this case, the attacker was able to inject code onto Tescos website, allowing them to extract customer data.

The leaked information included customer email addresses, passwords stored in plain text, and balances from Tescos loyalty reward program. This type of information can be used for phishing attacks, identity theft, and other malicious purposes. Tesco promptly notified affected customers and advised them to change their passwords and be cautious of phishing emails.

The breach is a reminder of the importance of website security and the need for organizations to take robust measures to protect customer data. It also highlights the risks of using weak passwords and reusing passwords across multiple websites.