Dear Member or Customer
I am writing to tell you about a security incident affecting The Northumbrian Pipers’ Society website, and to explain what you can do to protect yourself.
What happened
On 25th October 2026, we discovered that an unauthorised person had gained “administrator access” to our website. We immediately instructed our website contractors to secure the site, to minimise any further risk and began an investigation.
What information may be affected
Our website holds certain information about members and customers of our online shop. Although there is no evidence that any of this data has been copied or downloaded, our advisers tell us that they cannot rule it out.
The information that could potentially have been accessed includes your:
- Name
- Postal address
- Email address
- Membership details
- Order history
Card and bank details are processed by PayPal and GoCardless and are not stored on the website.
Passwords are stored in hashed (scrambled) form, rather than readable text, so should be secure, but we cannot rule out the possibility that they may have been exposed.
What we are doing
- We have reported the incident to the Information Commissioner’s Office (ICO).
- We are working with our website consultants to secure our systems against this incident, and seek to prevent this happening again.
- We are investigating how the website became vulnerable to this attack.
What you should do
Although, there is no evidence that the hackers have actually copied or downloaded any data from our website, as a precaution, the general advice in any situation like this is that you should:
- Change your password on our website straight away, using a strong, unique password that you don’t use anywhere else. To make things simpler, we will be sending you a link to reset your password, imminently.
- Consider changing it elsewhere too. If you have used the same or a similar password on any other site or app, change it there as well, starting with email and banking.
- Consider turning on two-factor authentication on your important accounts, where it is available.
- Be alert. If criminals did access any of your information, they may use your details to send convincing emails, texts or calls that appear to come from us or another organisation. Be wary of unexpected messages that ask for personal information, urge you to act quickly, or contain links or attachments.
- Check your accounts. Keep an eye on your bank and card statements and online accounts for anything unfamiliar, and report anything suspicious to your bank straight away.
- Forward any suspicious emails to the National Cyber Security Centre at report@phishing.gov.uk, and forward suspicious texts to 7726.
- Report fraud. If you think you have been a victim of fraud or cybercrime, contact Action Fraud on 0300 123 2040 or at actionfraud.police.uk.
I am sorry!
We live in times where, sadly, there are people who will go to great lengths to access personal information for criminal purposes. Like most organisations, we try very hard to do all we can to protect your information, whilst also having the convenience of a website and an online shop. We take the security of your information very seriously. We hope that we caught this intrusion in time to prevent any important information being taken and that this message proves to be unnecessary, but we wanted to alert you to the possible risk, so you can take any action you feel you need to.
On behalf of the Society, I sincerely apologise for this incident and any worry it may cause. If you have any questions, please contact me.
We will update you if we learn anything further that affects you.
Yours sincerely,
Andrew
Andrew Davison, OBE
Chairman
chairman@northumbrianpipers.org.uk
