Fortnum & Mason

Fortnum & Mason is a luxury retailer headquartered in the United Kingdom. The company engages with its customers through various promotional activities, including surveys and competitions, which are often facilitated via third-party service providers. These interactions allow the collection of participant information such as email addresses, and in some cases, physical addresses, contact numbers, and social media handles. The organization's operational model relies on external partners for certain customer-facing initiatives, indicating a structured approach to marketing and customer engagement while maintaining its core retail functions.

In June 2018, Fortnum & Mason experienced a data breach impacting approximately 23,000 individuals who had participated in surveys or competitions through a compromised third-party provider. The incident exposed primarily email addresses, with a smaller subset of records containing additional personal details. Notably, no financial data or passwords were accessed, and the breach did not affect the retailer's own website or internal systems. Upon discovery, Fortnum & Mason immediately terminated all integrations with the affected provider and notified the impacted individuals. The third party addressed the vulnerability and launched forensic investigations to prevent recurrence, demonstrating the company's incident response protocols and reliance on external partners for data processing. This event highlights the importance of third-party risk management in the retailer's data security framework.