Worten Cyberattack Exposes Customers' Tax ID, Email and Phone

Worten, a retailer in the Sonae group, confirmed it was the target of a cyberattack that allowed unauthorised access to personal data of a small group of customers. The company disclosed the intrusion on Wednesday, 11 November 2026, according to Pplware, and detailed the affected data on Thursday, 12 November, in a message sent to customers, according to ECO.

What data was accessed in the Worten cyberattack?

According to the Worten message cited by ECO, four types of information were affected. The NIF is the Portuguese tax identification number, tied to each taxpayer.

• NIF (tax identification number);
• phone number;
• email address;
• in some cases, the identification number of orders placed.

The company states, according to ECO, that no information was altered or deleted and that no payment data, such as bank cards, nor passwords or other account access credentials were accessed. Pplware reports the same assurance: neither passwords nor payment data were compromised.

since no passwords were accessed, this data does not allow access to your Worten account or payments in your name

How did Worten respond, and what is still unknown?

According to the same message, Worten says it immediately activated its internal cybersecurity incident response protocol and contained the situation. It also says it fixed the source of the attack, strengthened the protection of access to its systems and is working closely with the competent authorities, according to ECO and Pplware. The company describes the episode as a criminal cyberattack and says it wants transparent communication with its customers.

Worten refers to a small group of customers, but the two sources read do not give the number of people affected. Left unclear in those sources:

• how many customers were affected;
• how the attackers got into the systems;
• who is behind the attack;
• which authorities were notified, and when.

Why are a tax ID and an email enough for a scam?

Worten says, in the message cited by ECO, that the main precaution is to watch for possible fake contacts, by email, SMS or phone, from someone who mentions the customer's NIF or an order to seem trustworthy. This kind of scam, known as phishing when it imitates a trusted entity to obtain payments or credentials, gains credibility when the fraudster quotes real data.

Pplware explains the logic: knowing a NIF or an order number can help a fraudster make a message more convincing, but those details alone do not prove that a contact is legitimate. Even when passwords stay protected, the site stresses, the exposure of personal data calls for attention to the contacts one receives.

What should you do if you receive a suspicious message?

Pplware recommends that, faced with an unexpected message asking for payments, credentials or confirmation codes, the customer confirm the request directly in the app or on Worten's official website. It also recommends avoiding the links sent in that message. In practice, these signs deserve suspicion:

• a payment request the customer was not expecting;
• a request for credentials or confirmation codes;
• a link sent in the message itself, instead of direct access to the app or the official website;
• a message that quotes the NIF or an order to seem trustworthy, which does not prove where it comes from.

What does this change for businesses in Portugal?

This case shows that data seen as low-risk, such as a tax ID, a phone number or an email address, is enough to fuel credible scams, even when passwords and cards stay intact. For a Portuguese company that holds this kind of customer data, that means reviewing what information it keeps and for how long, because what is not stored cannot be exposed.

It also means preparing the incident response protocol before it is needed, as Worten says it did, and communicating with customers quickly and concretely, stating exactly which data was affected and what precautions to take. In general terms, the General Data Protection Regulation (GDPR) provides that personal data breaches must be notified to the supervisory authority, in Portugal the CNPD, as a rule within 72 hours. The sources read do not say whether or when Worten did so.