The Magasin cyberattack has prompted the Danish department store chain to warn nearly two million members of its Goodie loyalty programme that their personal information may be at risk. The company detected unauthorised activity in parts of its IT systems on Sunday, 18 October, and sent the warning early on Wednesday.
Members were urged to change their passwords and be cautious about suspicious messages, according to TV 2 Kosmopol. Magasin said the attackers may have been able to access information connected to customer profiles, including names, contact details, addresses and purchase histories.
What the Magasin cyberattack could have exposed
Such information could be used to make phishing attempts more convincing. These scams typically involve messages that impersonate a familiar company to persuade recipients to disclose confidential information or follow malicious links.
However, Magasin has not established whether customers’ personal information was actually obtained. In a subsequent statement reported by TV 2 Kosmopol, the company said it had contacted all its nearly two million Goodie members as a precaution while investigating the incident. The number refers to members notified, not a confirmed total of people whose data was stolen.
The retailer says payment card information was not affected, because it is handled by an external payment provider and was not stored in the compromised systems.
Magasin stores remain open during the investigation
In an official statement issued on 21 October, Magasin said the incident had disrupted some internal operations. Employees at some stores initially had to handle tasks manually, but its department stores and online shop remained open.
Magasin has reported the intrusion to the police and the Danish Data Protection Agency (Datatilsynet). It is working with external cybersecurity specialists to establish the scope of the breach and whether information relating to customers, staff or business partners was affected.
Another security breach after the DTU and CPR incidents
The incident follows other significant cybersecurity breaches in Denmark in recent weeks, although there is no established connection between the attacks.
On 2 October, the Technical University of Denmark (DTU) disclosed a breach of its identity management system. Information relating to up to 200,000 current and former users may have been affected. NordiskPost subsequently reported that the intrusion had gone undetected for five days.
On 5 October, Danish authorities revealed unauthorised access to names, addresses and personal identification numbers in the Central Person Register (CPR), involving approximately 8.8 million records. This figure also includes people who have died or moved abroad. Later reporting raised questions about how the activity had escaped detection.
For Goodie members, the immediate concern is the potential misuse of personal information in fraudulent communications. The investigation into Magasin’s systems is still determining whether any customer data was taken.
