The threat actors were successful in gaining access to Subway UK customers’ names and email addresses by hacking a Subcard server responsible for its email campaigns.