New World Clubcard members are being asked to change their online passwords after a cyber attack.

One expert is questioning why customers were allowed to set weak online passwords and have “0000″ passwords on their physical cards.

“Foodstuffs North Island and Foodstuffs South Island have identified a recent attempt by scammers to gain unauthorised access to a limited number of New World Clubcard accounts,” a spokesman for New World owner Foodstuffs said.

“This activity is consistent with what’s known as a ‘password spraying’ attack, where commonly used or previously compromised passwords are tested across many accounts.

“We want to reassure our customers that Foodstuffs’ systems have not been breached or compromised in any way.

“The issue has arisen where some customers’ passwords have been successfully guessed by scammers using automated tools.”

The spokesman said no personal credit card data has been compromised: “Foodstuffs never stores full [credit] card numbers.”