Some customers of Samsung UK have been impacted by a data breach following the exploitation of a third-party business application used by the tech giant.

Samsung UK has informed affected customers of the incident, with an alleged screenshot of the email shared on social media by Troy Hunt, the creator and owner of breach-checking site Have I Been Pwned?.

The email asserts that the breach impacts some personal information of certain customers who made purchases on its eCommerce site, specifically between the dates of 1 July 2019 and 30 June 2020.

The information involved in the breach includes names, phone numbers, email addresses, and physical addresses — but not passwords or financial information, the company said.

In the email, it was mentioned that the incident was determined on 13 November 2023.

A Samsung UK spokesperson told DIGIT: “We were recently alerted to a cybersecurity incident, which resulted in certain contact information of some Samsung UK e-store customers being unlawfully obtained.

“No financial data, such as bank or credit card details, or customer passwords, were impacted.

“We have taken all necessary steps to resolve this security issue, including reporting the incident to the Information Commissioner’s Office and contacting affected customers.”

The company didn’t go on to state how many customers may have been impacted, or what the third-party application which was exploited was.

Recommended reading

• Samsung Apologises for Scaring Customers With Mysterious Alert
• Apple and Samsung Fined over “Planned Obsolescence”
• Samsung Phones Silently Sending Out Your Private Photos

Speaking on the issue, Muhammad Yahya Patel, lead security engineer at Check Point Software, told DIGIT: “The supply chain is notoriously difficult to fully secure, particularly when chains of suppliers are involved.

“That is why it is so important that organisations actively monitor third-party access on the network to spot security gaps and plug them before they become attacks in the wild.”

“It also serves as yet another reminder for consumers to keep their own security in check. It is possible that hackers may leverage the stolen information to launch phishing attacks in the future using the Samsung brand as a lure.”