Harrods reported attempts to gain unauthorised access to some of its systems on April 29, 2025. The retailer said it restricted internet access at its sites as a precaution, but its Knightsbridge flagship, H Beauty stores, airport stores and website remained open. The available reporting does not establish a confirmed ransomware deployment, customer-data theft or prolonged outage.
What happened at Harrods?
Harrods said its IT security team had identified “attempts to gain unauthorised access to some of our systems.” The company said it took proactive steps immediately, including temporarily restricting internet access at its sites.
As an Amazon Associate I earn from qualifying purchases.
The disclosure was made on Tuesday, April 29, 2025, and reported publicly on May 1. Harrods did not say when the attempted access began, how long it lasted, which systems were targeted or whether an attacker successfully accessed them. Contemporaneous reporting said the retailer’s physical locations and online shop remained available.
Were Harrods stores or its website closed?
No. Harrods said its Knightsbridge store, H Beauty stores and airport stores remained open. It also said its website continued to operate for online shopping.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Some customers reportedly experienced difficulty accessing the website, and one customer said they were unable to pay for a purchase. Those reports do not establish a sustained website outage or a company-wide failure of Harrods’ payment systems. The disclosed mitigation was restricted internet access at sites—not closure of the stores.
Was this a data breach or ransomware attack?
That has not been established by the available public information.
Harrods disclosed an attempted intrusion, not a confirmed data breach. It did not identify any stolen or exposed information, affected data categories, malware, ransom demand or encrypted systems. It also did not name an attacker.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsRank #2
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
Those distinctions matter. “Targeted” or “attacked” does not automatically mean that an organisation’s files were accessed, customer information was exfiltrated or ransomware was deployed. The strongest accurate description is an attempted unauthorised-access incident with limited publicly reported operational impact.
Harrods’ privacy policy describes security measures including encryption, pseudonymisation and third-party assessments. Those general statements do not prove whether the 2025 incident did or did not compromise information.
What did customers need to do?
Harrods reportedly told customers that they did not need to take any special action at that stage. That advice could change if the company later confirms that customer information was affected, so customers should rely on official Harrods communications rather than social-media speculation.
Rank #3
- Quad Core J3710 Processor: F3 firewall hardware with Pentium J3710 Processor, 4 Cores 4 Threads, 2M Cache, up to 2.64 GHz, TDP 6.5 W. Compatible with pfsense, OPNsense, Linux, ESXi, Proxmox
- 4 x i225V 2.5GbE LAN: J3710 mini pc with 4 x i225V 2500Mbps LAN, can monitor network data, improve network security, powerful and widely used
- DDR3 RAM mSATA Slot: J3710 firewall pc with 1 x DDR3L SO-DIMM memory, 1 x mSATA SSD slot, 1 x SATA 3.0 slot(SATA Cable included), 1 x Mini-PCIe Slot
- HD DP Dual Display: Micro firewall appliance J3710 integrated HD Graphics, HD + DP dual display interfaces improve work efficiency
- Fanless Mini Size: Firewall appliance J3710 with aluminium alloy body, fanless quiet running without noise. Size only 11 x 10 x 3.5 cm
Prudent precautions include:
- Be alert for emails, texts or calls pretending to be from Harrods.
- Do not provide passwords, card details or one-time security codes in response to unsolicited messages.
- If you reused a Harrods password elsewhere, change it on those other services and enable multifactor authentication where available.
- Monitor bank and card statements as a general precaution.
- Do not cancel cards, freeze accounts or assume identity theft without evidence of payment or personal-data compromise.
The Information Commissioner’s Office advised consumers affected by the wider retail incidents to monitor company updates, use strong unique passwords and follow retailer-specific instructions.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →How did Harrods compare with Marks & Spencer and the Co-op?
Harrods’ disclosure came during a wider sequence of UK retail cyber incidents in late April and early May 2025. Marks & Spencer had reported a more disruptive incident affecting areas including online orders, payment-related operations and parts of its supply chain. The Co-op disclosed an attempted cyberattack and shut down parts of its IT environment as a containment measure.
In that news cycle, Harrods was described as the “third” major UK retailer incident. That was a time-specific description of the sequence being reported in early May 2025—not a definitive ranking of all UK retail cyberattacks in 2025 or 2026.
Rank #4
- BUSINESS READY - pfSense+ software updates included for product lifetime. Netgate TAC Lite technical support included. One year hardware warranty included.
- COMPLETE - Pre-loaded with pfSense+ software to get up and running fast. Simply unbox it and start customizing for your secure edge networking needs. Free help with setup from our expert Technical Assistance Center (TAC) available 24/7/365.
- POWERFUL - A dual core ARM Cortex-A53 1.2 GHz delivers near gigabit routing of common home iPerf3 traffic and in excess of 650 Mbps of firewall throughput.
- COMPACT - Low power draw, a compact form factor, and silent operation allow it to run unnoticed when placed on a desktop, wall, or rack.
- FLEXIBLE - Three (3) 1 GbE switched (WAN/LAN/OPT) ports allow you to configure three separate 1 GbE switched ports for upto a gigabit of bi-directional traffic.
The incidents’ close timing led to speculation that they might be connected. However, proximity alone does not prove a shared campaign, common tools or a common perpetrator.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Who was behind the incident?
No attacker was publicly confirmed in the reviewed material. Commentary speculated about a possible connection to the threat group Scattered Spider, but neither Harrods nor the UK authorities cited here confirmed that attribution.
The evidence should therefore be separated into three categories:
Best Value
- Entry-Level Privacy Gateway: Designed for users who want simple online privacy protection at an affordable level—ideal for basic home networking and daily internet use.
- Secure Browsing for Everyday Needs: Perfect for email, social media, online shopping, and standard streaming—protecting your connection while keeping setup and operation easy.
- Lightweight Protection Against Common Online Threats: Helps reduce exposure to unwanted ads, trackers, and risky websites, improving online safety for your household.
- Simple Setup, No Technical Skills Required: Plug it in, follow the quick steps, and start using—an excellent choice for beginners who don’t want complicated network configurations.
- Decentralized VPN (DPN) Included – No Monthly Payments: Get built-in decentralized VPN access with lifetime free usage, helping you stay private without paying recurring subscription fees
- Confirmed: Harrods reported attempts to gain unauthorised access to some systems.
- Unconfirmed: The incident may have been related to attacks affecting other retailers.
- Not established: Scattered Spider or any other named group carried out the Harrods incident.
What did UK authorities say?
The National Cyber Security Centre said on May 1, 2025 that it was working with organisations affected by the retail incidents and providing expert advice to the wider sector. It described the events as a warning for organisations to strengthen prevention, response and recovery planning.
The ICO said on May 2 that it had received reports from Marks & Spencer and the Co-op. Its statement did not specifically identify Harrods as a reporting organisation. That means it would be inaccurate to say the ICO had confirmed a Harrods data breach.
What remains unknown?
Based on the public information available for this incident, important questions remain unanswered:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →- Which Harrods systems were targeted?
- Was unauthorised access actually achieved?
- Was any information accessed or removed?
- How long did the activity continue?
- Was the incident connected to the M&S or Co-op incidents?
- Did Harrods later issue customer-specific notifications?
The absence of a public confirmation of data theft is not proof that no data was accessed. It means only that the reviewed sources did not establish it. Equally, the existence of an attempted intrusion is not proof of a successful breach.
The bottom line
Harrods was clearly targeted in April 2025, but the publicly described event was a contained attempted intrusion rather than a confirmed ransomware attack or customer-data breach. Its stores and website remained open, and customers were not initially told to take special action. The sensible response is to follow official updates, protect reused passwords and watch for phishing—without assuming that personal information was stolen.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
