Tesco has been forced to deactivate more than 2,000 Clubcard accounts after they were hacked and log-in details shared online.
Hackers obtained details from other sites before using them to access the details of the supermarket's customers.
Tesco has promised to issue replacement vouchers for those affected.
It echoes a similar attack last year
A Tesco spokesperson said: "We take the security of our customers' data extremely seriously and are urgently investigating these claims.
"We have contacted all customers who may have been affected and are committed to ensuring that none of them miss out as a result of this.
"The security of our customer's data is of the utmost importance to us, and we apologise sincerely to any of our customers who were affected. We are conducting a thorough review of our processes to ensure this never happens again."