Royal Mail customer information has been exposed online following an apparent data breach today.

According to a notice issued on the Royal Mail Click & Drop status website, for a time, some users were able to view information belonging to other customers and their orders.

Click & Drop is Royal Mail’s parcel shipping service, which is used by both businesses and individual customers.

So what has happened?

Royal Mail data breach?

Royal Mail first began investigating the issue at around 1pm BST, and later issued a statement to confirm the breach and notify customers that it had temporarily halted access.

“We have been made aware there was an issue affecting Click & Drop that meant some customers could see other customer’s orders,” the delivery giant said.

“As a protective measure, we have stopped access to Click & Drop temporarily,” the statement added. “We fully understand and apologise for the inconvenience caused by this. Our engineers are working as hard as possible to get the site back up and running as expected.”

At 15:24, Royal Mail issued an update stating that the website was still disabled while engineers find a fix.

“We are continuing to work on a fix for this issue, and we still hope to have the site back online as soon as possible,” the company said.

At the time of publication (15:30), the Click & Drop site was still unavailable.

‘Unacceptable’

Disgruntled customers took to social media this afternoon to complain about the ongoing issues.

Some commented that they had been able to view customer information and orders for both businesses and individual customers.

“I saw everyone’s details who ordered some tools etc from Amazon today, 162 orders that are not mine and the details are all there for me to see,” one user claimed.

Recommended

• Five things you need to know about the OpenSSL patch
• Why it’s important to exercise your cyber defences
• Calls for probe after reports that Liz Truss’ phone was hacked

Another said: “Data protection breach is a very serious matter. I saw three other businesses orders for around 20 customers. What is @royalmail comment on this?”

Responding to Royal Mail’s update tweet, a business account asked: “How can you let this happen? I’ve logged on and can see another businesses orders and all their details.

“GDPR came in for a reason! It’s not an issue RM, it’s a serious data breach!”

A Royal Mail spokesperson said: “Royal Mail has temporarily suspended its Click & Drop website as a precautionary measure following reports that some customers were able to see information about other customers’ orders following a technical problem.

“We are investigating the incident in order to fix the IT systems issue. We apologise for any inconvenience.”

DIGIT Expo 2022 | Join the Conversation

DIGIT Expo is Scotland’s largest gathering of senior technology personnel and an unmissable opportunity for knowledge exchange, networking and business opportunity.

The conference will feature an array of tech leaders, innovators and world-class speakers exploring key themes such as AI, DevOps, cyber security, digital leadership, cloud computing, Web3 and data innovation.

Find out more at: www.digit-expo.com