Cybercriminals Strike Again: Payment Data Stolen in Five-Day Online Attack – A major cyberattack has compromised payment card details from an online retail store, exposing customers to potential fraud. The breach, which lasted five days, has prompted an urgent investigation and security overhaul as affected individuals are being notified.

{“remix_data”:[],”remix_entry_point”:”challenges”,”source_tags”:[“local”],”origin”:”unknown”,”total_draw_time”:0,”total_draw_actions”:0,”layers_used”:0,”brushes_used”:0,”photos_added”:0,”total_editor_actions”:{},”tools_used”:{“transform”:2},”is_sticker”:false,”edited_since_last_sticker_save”:true,”containsFTESticker”:false}

Leeds United Boots Out Card Swipers Following Five-Day Cyberattack
Football club issues apology after fan payment details are stolen from its online store

Leeds United has confirmed that cybercriminals breached its retail website in February, managing to steal card details from “a small number of customers” over a five-day period.

According to the club, the attack occurred between February 19 and 24.

When contacted for further details regarding the extent of the breach, including whether any additional personal information was compromised and how many fans were affected, Leeds United declined to comment.

However, the club assured that those impacted have already been notified and that it is working closely with the UK’s Information Commissioner’s Office (ICO) on the matter.

“A forensic investigation was undertaken by a specialist third party as soon the club discovered the breach, and measures were implemented to stop and recover from the attack,” said Leeds United.

“The club is disappointed that the attack was successful despite layers of cybersecurity, and offer our sincere apologies to anyone who has been adversely affected.”

Cybersecurity expert Jake Moore, who advises for Slovak security firm ESET, suggested that the hackers likely intercepted payment details from every transaction processed in the affected time frame.

“These types of attacks are cleverly able to penetrate a website and take copies of all payments with ease whilst hiding undercover,” he said. “In a short space of time, cybercriminals would have been able to swipe card payment details from all transactions from within the time frame affecting all customers from that time.

“Although this digital heist can often go under the radar, it highlights the importance of robust protection, due diligence by all websites handling user’s financial data, and for website admins to monitor any anomalies, however small.

“Anyone affected by this breach should contact their bank immediately to cancel the compromised card, request a replacement, and follow the bank’s fraud prevention guidance.”

The English Football League (EFL), which oversees the Championship—the league where Leeds United currently leads—had previously warned clubs about cyber threats. In September 2024, cyberattacks led to breaches at the email systems of rival clubs Bristol City and Sheffield Wednesday.

Hackers infiltrated both clubs’ email accounts and sent phishing links to fans. Following the incidents, the EFL advised all 72 clubs under its governance to be cautious about emails allegedly from Bristol City’s CFO Vicki Long or Sheffield Wednesday’s finance director John Redgate.

League One club Charlton Athletic also reported cybersecurity issues that month, though its breach stemmed from legacy IT infrastructure following a transition to cloud-based systems.

Given the financial stakes in professional football, it’s no surprise that cybercriminals frequently target clubs, including ransomware gangs. In recent attacks, Italy’s Bologna FC was hit by RansomHub in November, while the San Francisco 49ers—competing in American football—fell victim to BlackByte in 2022.