Rohlík customer data stolen in cyberattack on its support system

Online supermarket Rohlík said Sunday that attackers stole customer information after breaching a tool used by its customer support team.

The exposed data included names, email addresses and communications with support staff or the company’s virtual assistant. For some customers, it also included telephone numbers, call transcripts and files uploaded to chats, company representative Ondřej Obergruber told ČTK.

Rohlík said its login and payment systems were not compromised and its app continues to operate normally. The company is emailing affected customers and has reported the incident to Czech cybersecurity and data protection authorities.

The breach affected information contained in support emails, chats and calls, according to the company. Rohlík said it had fixed the vulnerability and prevented more extensive data theft.

The information provided to ČTK did not specify how many customers were affected, when the attack occurred or who was responsible.

Although the company says its payment and login systems were unaffected, sensitive information could still have been exposed if customers had included it in their support conversations.

Rohlík said it had directly contacted customers who had shared passwords or payment card details in those communications.

The incident was reported to the National Cyber and Information Security Agency, known as NÚKIB, and the Office for Personal Data Protection, the Czech authority overseeing personal data protection.

Erwin Brunner, speaking for the company’s management, expressed regret over the unauthorized access and said necessary security measures had been taken.

Rohlík reminded customers that it never asks them to provide passwords or payment card details.

The company also said it sends payment links or bank transfer instructions only following a prior agreement with the customer. An unexpected message asking for payment or sensitive information should therefore be checked directly with customer support.

As a precaution, customers should be alert to messages that refer to previous orders or support conversations and use those details to appear trustworthy. Familiar information alone does not establish that a message is genuine.

Anyone notified that a password they shared was exposed should change it, including on other services where the same password was used. Customers whose card details may have been included should contact their bank for advice.

For questions about the incident, Rohlík lists its customer support number as 800 730 740 and its email address as zakaznici@rohlik.cz. Its data protection officer can be reached at privacy@rohlikgroup.com.

Customers receiving a suspicious email can verify it through those contacts or by opening the Rohlík app directly, rather than following links in the message.