It appears that someone has hacked into the computer systems of five brands owned by JD Sports Fashion: namely JD, Size?, Millets, Blacks, Scotts and MilletSport.

According to the company, the information lifted from its databases would concern 10 million unique customers and should be limited to their name, their billing and delivery addresses, their email address, their phone number, the details of their orders and the final four digits of their payment cards. JD has “no reason to believe that account passwords were accessed.”

The company says it is “working with leading cyber security experts,” “engaging with the relevant authorities, including the U.K.’s Information Commissioner’s Office (ICO),” and “contacting affected customers” to warn them of possible fraud and phishing attacks.