Front Systems breach reaches shoppers at Norwegian clothing chains

Front Systems, a cloud point-of-sale and store system used by many fashion and outdoor retailers in Norway and its neighbours, says an unauthorised party got into its software on November 5, 2026 and pulled data out of it. Its parent company, the Danish software group EG, announced the breach on November 11. Because Front Systems runs the tills and customer records for its retail clients, the people who may be affected are those stores’ shoppers and staff. Here’s what has been said so far.

What EG and Front Systems have said

In its statement, EG says:

• The intruder had access for about four hours on the evening of Thursday, November 5.
• They extracted about 0.2% of Front Systems’ production database.
• EG is still working out exactly which data was taken, but says it has to assume for now that it includes customer names and email addresses.
• Payment card details were not exposed, because they aren’t stored in the affected system.
• The vulnerability is closed, the incident has been reported to the police, and outside specialists are helping with the investigation.

EG hasn’t said how the intruder got in or who was behind it, and no group has publicly claimed the attack.

What stores were told

NRK, Norway’s public broadcaster, saw the letter Front Systems sent to its retail customers. According to NRK, it says employee and personnel information, gift card and credit note details, and customer and order details from the chains’ online stores may also be involved. Stores were told to accept only physical gift cards and credit notes for now, and that mapping the full scope will take time. Front Systems says its system is used in more than 10% of Norway’s fashion stores.

The letter also left it to each store, as the data controller, to decide whether the breach must be reported to Datatilsynet, the Norwegian data protection authority, and whether to tell their own customers. Datatilsynet told NRK it has received reports from businesses and is working out the scope and which companies are affected.

Retailers are now writing to their customers. NRK reports that Bergans has notified Datatilsynet, deactivated customer user accounts, changed passwords and is watching transactions, though it hasn’t yet been told that its own data was involved. The chains Brando and Floyd have emailed their customers, NRK says. The Norwegian shop The Apothecary told its customers the breach may include full name, address, gender, email, phone number, receipt data and online orders, even though it hasn’t yet had confirmation that its customers are affected.

What this means for you

If you shop at a Nordic clothing or outdoor store, your name, email, phone number and purchase history could be in a store system like this one even if you never made an account. Receipt and order details are useful to scammers: a fake “your order” or “your gift card” message that names a real store and a real purchase is much easier to believe. Card numbers weren’t in the system, so nobody can use this breach alone to pay with your card.

What you can do

1. Read any notice from a store you shop at, and follow its advice. Stores are still finding out whether their customers are involved.
2. Be careful with emails, texts and calls about orders, returns, gift cards or credit notes, especially ones that ask you to log in, pay a fee or confirm card details. Go to the store’s website or app yourself.
3. Change your password if a store you use asks you to, and don’t reuse it anywhere else.
4. Use up gift cards and credit notes in person if your store asks you to, since stores have been told to accept only the physical versions for now.

How Frame helps

Front Systems and the stores haven’t published a list of affected email addresses, so there isn’t a breach record to add in Frame yet. If a store tells you your details were involved, add the breach to a verified email in Frame for a short checklist. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame’s email aliases let you give each store its own address, so a leak at one shop doesn’t reveal your main inbox. Frame never collects or stores the leaked records themselves.

Related coverage

• Landmark Group says some Shukran loyalty members had names and contact details accessed: another retail customer database breach disclosed this week.
• Who Gives A Crap says a marketing provider exposed customer names and addresses: a breach at a service provider that reached a brand’s customers.

Sources

• EG, Information about a data breach at Front Systems, November 11, 2026 (also in Norwegian)
• NRK, Omfattende innbrudd i datasystemene til norske kleskjeder (in Norwegian), November 11, 2026
• The Apothecary, Sikkerhetshendelse hos vår underleverandør, Front Systems Kassasystem (in Norwegian and English), November 2026