Smartphone seller Dixons Carphone says it is investigating a data breach of some 5.9 million customer bank card details and 1.2 million personal data records.
The retailer says it has contacted the relevant card companies as well as police and data authorities but says there was no evidence of fraud on the cards as a result of the incident.
The Information Commissioner's Office is investigating the matter, but it was not immediately clear whether the breach would be subject to the stringent new data protection rules that came into effect last month.
The regulation requires companies to report data breaches within 72 hours or face significant penalties.
The ICO says the incident has been reported. The timing would be a matter for investigation.
Explore further: EU: new rules will make data breaches 'very expensive' for firms