Threat watch / Breach
Worten: attackers exploit a flaw to reach customer and service-provider data
Portuguese electronics retailer Worten (Sonae group) says it was the victim of "a criminal act of unauthorised access" to some customer and service-provider data, through a vulnerability it has since fixed. For a small group of customers, the attackers reached their tax number (NIF), phone number, email address and in some cases an order number. Worten says no payment data, cards or passwords were accessed, has informed affected customers and is working with CNCS, the CNPD and the Polícia Judiciária.
- Sector
- Retail
- Way in
- Software flaw
- Product or vendor
- Worten
- How it happened
- Worten says it fixed the "exploited vulnerability" and strengthened access protection. It has not named or described the vulnerability.[1][2] Checked 15 Nov 2026
- What was stolen
- Tax identification number (NIF), phone number, email address and, in some cases, the order identification number. Worten says payment data, bank cards, passwords and other login credentials were not accessed, and no data was changed or deleted.[1][2] Checked 15 Nov 2026
- Who was impacted
- "A small group of customers", in Worten's words, plus some service providers. The number of people is not public.[1][2] Checked 15 Nov 2026
- Threat actor
- Not attributed
Timeline
- An official Worten source confirms to Lusa an unauthorised access to some customer and service-provider data. The company says the exploited vulnerability is fixed, normal operations were not affected, and it is working with CNCS, the CNPD and the Polícia Judiciária. [2]
- Worten writes to affected customers that it "was the victim of a criminal cyberattack", lists the data reached and warns of fake emails, texts or calls that use their NIF or an order number to look genuine. [1]