Hackers can combine leaked data to target consumers, expert warns

People whose details were accessed through a breach involving Magasin’s customer club should watch for phishing attempts, cybersecurity professor Jens Myrup Pedersen told DR. The exposed information may include names, addresses, email addresses, phone numbers, purchase histories, dates of birth and gender.

Criminals could use those details to make convincing, personalised messages, said Pedersen, a professor of cybersecurity at Aarhus University. An email referring to a book someone bought, or recommending a book based on past purchases, might seem legitimate and persuade the recipient to click a link and enter more information.

Phishing involves fake emails, messages or calls designed to trick people into revealing personal details, such as payment card or MitID information. The Sikkerdigital.dk website advises people not to respond to phishing emails.

Information from separate leaks can be combined to build a detailed picture of a person and their interests, Pedersen said. He cited the recent theft of Danish personal identification numbers and information made available through the Land Registration Court about loans on people’s homes. Social media posts can also reveal details about someone’s friends, activities and interests.

“When you put all those pieces together, you can make a fairly precise puzzle,” he said. Pedersen advised people to improve their own security by changing passwords, using different passwords for different websites and enabling two-factor authentication.

Consumer group urges caution over loyalty clubs

Companies can also use personal information for targeted marketing, said Ida Daarbak Reislev, a senior legal adviser at the Danish Consumer Council Tænk. Details such as gender, age and address can help a business predict what a customer might buy. Combined with information about what people view or add to their online shopping baskets, the data can provide a detailed picture of them as consumers.

Personalised marketing is widely used and can encourage consumers to buy more, Reislev said.

The Competition and Consumer Authority advises people considering customer clubs to ask whether the offers really save them money, whether they need the products, and whether discounts apply to all items or only selected ones. Consumers should also check whether points expire or come with conditions, whether they want the club’s newsletters, and what personal information they must provide to join.

The breach may prompt people to consider what information they share with businesses and how many customer clubs they join, Reislev said. Every time people give a company their details, they must trust it to protect them, she said, adding that the more companies hold someone’s data, the greater the risk that it could be compromised.

Customer clubs can be worthwhile, but they may also encourage people to spend more or buy things they do not need, Reislev said. She advised consumers to weigh the benefits against the time, messages and extra spending a membership may bring, and to limit the number of notifications and emails they receive.