Department store chain Magasin has warned members of its Goodie customer club that unauthorized people accessed parts of its IT systems and may have obtained names, addresses and purchase histories.
Magasin told affected customers about the incident in an email that DR has seen. According to the email, unauthorized persons gained access to Magasin’s IT systems a few days ago and encrypted parts of them, leaving the company unable to use them.
In the email, Magasin says it regrets the confusion the incident may cause and that it is working to limit the scope of the breach. The company also states that credit card information is not covered by the breach, because it is stored in systems that were not affected.
What Magasin says about the scope of the incident
In a press release distributed via Ritzau, Magasin says the incident happened on Sunday, October 18, 2026. The company states that the potentially affected data includes names, contact details, addresses, purchase history and other information linked to Goodie profiles.
Magasin adds in the same press release that payment card data is handled by a payment provider and stored outside the affected systems. Stores and the webshop have continued to operate, although staff in some stores initially had to work more manually.
The company says it is still working to uncover the full scope, including which personal data about customers, employees and business partners may be affected. As reported by B.T., chief executive Peter Fabricius says Magasin is still in the middle of that work and does not yet have answers to everything.
Phishing warning and reports to the police and Datatilsynet
In the email to customers, Magasin notes that the obtained information can be used to make phishing attempts more convincing. The company therefore asks members to be critical of messages, emails and phone calls they receive.
Per TV 2 Fyn, Magasin advises Goodie members to change the password on their account and to be skeptical of links they may receive. Magasin also states that it is working with external experts to handle the incident and to restore access to its systems.
The security breach has been reported to the police and to Datatilsynet, the Danish Data Protection Agency. Magasin says customers with questions can contact its customer service or Datatilsynet about the incident.
What the Magasin breach means for internationals shopping in Denmark
Goodie is Magasin’s free customer club, and membership is tied to a profile with contact details and a record of past purchases. Datatilsynet is the Danish authority that supervises how companies handle personal data, and Magasin has named it as a point of contact for affected customers alongside its own customer service.
For foreign residents, the practical point in Magasin’s email is the phishing warning. Fraudulent messages that already contain a correct name, address and recent purchase can be harder to spot, especially for readers who are not yet confident in Danish. Magasin has not said how many people are affected or whether non-customer groups such as employees and partners are included, and says that work is still ongoing.
Magasin’s email asks members to change their account password and to treat unexpected links with caution, and the company states that card details were not in the affected systems. Anyone unsure whether a message is genuine can contact Magasin’s customer service directly rather than replying to the message. Datatilsynet handles complaints about data protection, and the breach is also with the police, which means further details may come from the investigation rather than from the company. Broader questions about retail cybersecurity in Denmark remain outside what Magasin has confirmed so far.
