MSE News: Tesco Clubcard holders: Consider changing password after breach

poppy10_2 · 18 February 2014 at 1:25AM

geordie_joe wrote: »

Because that was good security when the web site was developed.

It definitely wasn't. Good password security rules have been around longer than the internet has been in existence.

geordie_joe wrote: »

To try to change it now would involve 10 million people all trying to change their passwords at the same time and that would kill the system.

Umm, no. All you have to do is allow longer and more complex passwords for those that want to use them. You don't need to force existing users to change their passwords

terra_ferma · 18 February 2014 at 9:54AM

geordie_joe wrote: »

I've just been reading one long post from someone who got hacked twice. I'll call him a "he" to make things easier.

No it doesn't make things easy if you change a she into a he when you talk about a poster behind their back, instead of saying things in the thread they've been posting.
There is a difference between discussing/disagreeing and gossiping (should be the b* word but it would be censored...) about someone behind their back.

Smudge's_Lot · 18 February 2014 at 11:51AM

My clubcard account was hacked back in December last year when I think that the new keyfobs I ordered(which never arrived) were used to hack into the account where the thieves printed off my unused vouchers of value £259 and used them all in stores on one day down in London somewhere. I do not use them in stores but this did not ring any alarm bells at Tesco. It was only when I tried to use one, about Jan 20th that I found out that all my unused vouchers had been stolen.
I rang Tesco who very kindly put all the points back on with very few questions and offered a Crime number if I wanted to take it further with the Police.....I thought that should be their job, but hey ho!!
So I changed my password the daqy I found out and the latest vouchers are still there! Fingers crossed!
So, I think that this has been going on for a while, not just this week!

no1catman · 18 February 2014 at 12:13PM

Smudge's_Lot wrote: »

snip
So, I think that this has been going on for a while, not just this week!

No one is saying, least of all Tesco, that it's just happened, just that there has been a new development e.g. see the link on the first post, with No's & passwords available for others to see.
Hence the warning in general, and those affected their accounts were disabled.

littlecyberchick · 21 February 2014 at 12:52AM

Back in December I received an email from Tesco saying an order for printer cartridges I'd placed using Clubcard vouchers had been successfully cancelled. I contacted them immediately to say I'd not placed an order. They told me it was definitely my order and more or less said it must have been someone else in my family who had placed the order without my knowledge even though I argued that no one would as the cartridges ordered were the wrong type for my printer. As the order was already cancelled they said it didn't need further investigation. Two weeks ago I received my latest statement which had a different name printed on it but with my address. When I checked my account I found that £200 worth of vouchers had been used in a Tesco store and petrol station in Liverpool at the beginning of December - I live in Bristol - and the name, gender and phone number on the account had been changed. I again contacted Tesco Clubcard customer services who this time asked more questions and immediately realised the vouchers had been stolen. I was given the details of Action Fraud and told to contact them, which I did and passed on the name the account had been changed to. I'm really cross that Tesco obviously knew in December when I first contacted them that fraud was taking place and didn't check my voucher use, give me proper advice or warning and allowed the fraudster time to still access my account obviously hoping to benefit from future vouchers.

tonyarrow · 31 July 2014 at 9:33AM

I am one of those who has been hacked - twice. I use strong passwords and have changed the testcop Clubcard password twice.
I am in correspondence with Tescvo Head Office and have so far had 3 explanations of how the hacking was done and am still confused.

TH BASIC PROBLEM IS THAT TESCO.COM DO NOT ALLOW YOU TO CHANGE YOUR LOGIN ID - THEY INSIST YOU USE YOUR EMAIL ADDRESS.
TO HAVE UNIQUE LOGIN ID'S WOULD SOLVE THE PROBLEM.
WE HAVE THAT ON TESCO BANK (ADMINISTERED BY GOOD OLD RBS) - WHY NOT ON TESCO.COM?