Superdrug has warned its online customers to change their passwords after criminals claimed to have obtained their personal details.
The chain said the group claimed they had stolen details of 20,000 customers, but it had only seen evidence so far that 386 customers had been affected.
Names, addresses and “in some cases” date of births and phone numbers “may have been accessed”, Superdrug said.
No customers’ payment card details had been accessed, it said.
Superdrug said there was “no evidence” its systems had been compromised.
It said it believed the criminals had got customers’ email addresses and passwords from other websites “and then used those credentials to access accounts on our website”.
The group had tried to extort a ransom from Superdrug, it said.
The retailer said it had “notified directly” all customers which it believed had been affected.
It also posted a tweet, telling customers the email they sent was “genuine”.
Superdrug said it had informed the police as well as the UK’s national fraud and cyber-crime arm, Action Fraud, about the issue.
“We… will be offering them all the information they need for their investigation,” they said.