On the morning of 6 October 2026, shoppers in the United Kingdom woke up to a strange message on their phones. The mobile application of a large UK-based online fashion retailer displayed a push notification that was not an advert and not an order update. According to the BBC, the message was addressed to the retailer’s data protection officer and IT team, claimed that the retailer’s cloud data-storage environment had been fully compromised, and demanded contact on pain of a leak. The BBC quotes the names of the retailer and of the storage platform involved; this article withholds both, since neither the company nor any official source has confirmed anything at the time of writing. Dozens of users reported receiving the notification, and screenshots circulated widely on social networks the same morning. Sky News reported that the retailer’s shares fell by almost 5 percent as the reports emerged, that website issues had been observed shortly before 10 a.m., and that the company had not yet responded directly to press enquiries. At the time of writing, no intrusion, no theft of data and no leak has been confirmed by any official source or by the company itself. A threatening notification displayed on customers’ screens is a fact reported by the national press; a completed hack of customer data is, for now, only a claim made by the sender of that message. No liability is established, the retailer’s contracts and terms remain the reference for its customers, and only a court can decide who is responsible for what. This article explains, in general terms and under European Union and French law, what such a notification means, how to secure your accounts immediately, what the retailer and its IT providers must do, and which remedies are open to people living in France: complaint to the CNIL, criminal complaint, and compensation before the French courts.

I. Has my account been hacked? Reading the hacker notification and securing your data without delay

A. What the DPO message says, what a screenshot proves, and what remains conditional

The wording of the notification deserves a careful reading, because every word matters and none of them proves a data theft. According to the BBC, the message is addressed to the retailer’s “DPO and IT”, meaning its data protection officer (délégué à la protection des données, the person in charge of data-protection compliance) and its technical teams. It claims that a cloud data-storage environment used by the company has been “fully compromised” and demands contact, failing which data “will leak”. Three remarks follow. First, the recipients named in the message are the retailer’s own compliance and technical staff, yet the message was pushed to customers’ phones: the sender used the customer notification channel of the application as a loudspeaker, which tells us something about access to that channel but nothing reliable about access to customer databases. Second, the threat of a future leak is worded in the future tense: it announces what the sender says it could do, not what it has done. Third, the reference to a widely used cloud data-warehouse platform points, if the claim is genuine, to an attack through an IT provider rather than through the retailer’s own servers, a pattern already seen in earlier incidents involving other large companies that the BBC recalls. Each of these points will have to be established by investigation; at this stage they are hypotheses, and the article treats them as such throughout.

Whether this episode amounts to a personal data breach in the legal sense therefore cannot be answered today. A breach exists only if personal data, meaning any information relating to an identified or identifiable person such as a name, an email address, an order history or payment details, has actually been destroyed, lost, altered, disclosed or accessed without authorisation. A message claiming a compromise is not, by itself, that proof. The practical consequence is twofold. On the one hand, you must act as if your data could be exposed, because waiting for confirmation is the surest way to suffer the damage the sender threatens. On the other hand, you must not present the incident as an established theft, neither in your correspondence nor on social networks, because the facts are still being established and the company has not confirmed anything. Keep the screenshots, note the exact time the notification appeared on your telephone, and preserve the version of the application installed on your device. This evidence may later help the authorities, the data protection authority and, if needed, a court to reconstruct what happened.

Your first steps are technical and urgent. Open the retailer’s application and its website directly, by typing the address yourself, and never through a link received by message, email or social network in the hours following the incident: waves of fake messages that imitate the retailer and invite you to “check whether your account has been hacked” are the classic second act of such episodes. Change the password of the shopping account, choosing a long and unique password, and activate two-factor authentication where the application offers it. If you reused that password on other services, change it everywhere, starting with your email account, because control of your mailbox opens the door to password resets on all your other accounts. Check your bank statements and the payment methods saved in the shopping account for transactions you do not recognise, and consider removing a stored bank card from the account while the uncertainty lasts. If you receive calls, texts or emails that refer to the incident and press you to act quickly, to pay, or to hand over codes, treat them as attempted fraud: a retailer never asks for your full password or your bank codes by telephone. Each of these precautions costs little and protects a lot, whether or not the threatened leak ever materialises.

B. Your first rights against the retailer: information, access, and a written trace from day one

Once the urgent steps are taken, write to the retailer through its official channels. European data-protection law gives every customer a set of rights that can be exercised immediately, without waiting for the company to communicate about the incident. You may ask the retailer to confirm whether it holds personal data about you and to give you a copy of it, which is the right of access in Article 15 of Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). You may ask for the erasure of data that is no longer necessary or whose processing you contest, which is the right to erasure in Article 17 of the same Regulation, and you may object to direct marketing at any time. French law adds a general shield that judges apply broadly: Article 9 of the Civil Code states that « Chacun a droit au respect de sa vie privée. » (Everyone has the right to respect for his private life.), and allows the courts, including in urgent proceedings, to order any measure capable of preventing or ending an invasion of that privacy. Address your request to the data protection officer (délégué à la protection des données) whose contact details the retailer must publish, send it in writing, and keep proof of dispatch and of receipt. The retailer must normally answer within one month, a period stated in Article 12(3) of the Regulation. A companion guide published in French on this site walks through the same reflexes after a suspicious shopping-app notification and can usefully be read alongside this article: French-language guide to a hacked shopping-app notification and what to do for your data.

The content of your letter matters as much as its dispatch. State your identity precisely, identify the account concerned, describe what you received and when, with the screenshots attached, and list what you ask for: confirmation of whether your data is affected, a copy of the data held about you, the erasure of data you consider unnecessary, and information about the measures taken to secure the accounts. Ask for a written reply and set out the facts calmly, without accusing the company of a confirmed leak that no authority has established. This restraint is not politeness alone; it protects your own position. If the matter later comes before the CNIL or a court, a measured and documented correspondence shows a customer who acted responsibly, while public accusations of theft or of named individuals’ guilt, made before any finding, could backfire. If the retailer does not answer within the one-month period, or if its answer is evasive, that silence itself becomes a useful element for the next stage: the complaint to the supervisory authority and, where damage has occurred, the claim for compensation described in the second part.

II. What the DPO message and the cloud data store reveal: the 72-hour rule, the chain of IT providers, and your remedies in France

A. Who must notify the CNIL within 72 hours when the attack passes through a processor

Behind every online shop stands a chain of IT providers: hosting companies, payment processors, analytics tools, and cloud data-warehouse services in which customer data is centralised for analysis. European law distributes precise duties along this chain. The retailer that decides why and how customer data is processed is the controller (responsable de traitement). The company that stores or analyses that data on the retailer’s behalf is the processor (sous-traitant). Article 28(1) of the General Data Protection Regulation requires the controller to choose only processors that give sufficient guarantees of data protection Processing by a processor must be governed by a written contract that sets out, in particular, that the processor acts only on documented instructions from the controller. When the threatened compromise concerns the provider’s environment, the first legal question is therefore contractual: what did the agreement between the retailer and its provider require in terms of security, monitoring, and alerts, and were those clauses performed.

The Regulation then organises the flow of alerts upward and outward. If a processor becomes aware of a personal data breach, Article 33(2) requires the processor to warn the controller promptly once it becomes aware of a personal data breach Once aware, the controller takes over: Article 33(1) requires the controller to notify the competent supervisory authority promptly and, where feasible, within 72 hours of becoming aware of the breach, unless the breach is unlikely to create any risk for the affected people, with reasons given for any delay The notification must describe the nature of the breach, the categories and approximate number of people concerned, the contact details of the data protection officer, the likely consequences, and the measures taken or planned. The controller must also document every breach so that the authority can verify compliance. In France, the competent authority is the CNIL, and its online service explains the rules for breach notification and the procedure to follow.

Customers themselves must be warned directly, but only above a defined threshold. Article 34(1) of the Regulation requires the controller to warn affected people directly, in clear language and promptly, where the breach is likely to create a high risk for them That communication must describe the breach in clear and plain language. The Regulation excuses individual notification where the affected data had been made unintelligible, for example by encryption, where later measures removed the high risk, or where individual information would require disproportionate effort, in which case a public communication of equal effectiveness is required instead. A push notification written by the attacker is not the communication Article 34 contemplates; the real test is whether the retailer, once it has established the facts, informs its customers clearly and quickly. If nothing arrives in the days following the incident, customers may treat that silence as relevant, while remembering that the investigation itself takes time and that a hasty but wrong announcement helps no one.

The Court of Justice of the European Union has clarified how these duties are judged when a breach does occur. In its judgment of 14 December 2023 in case C-340/21, the Court held that unauthorised access by a third party is not, in itself, proof that the controller’s security measures were inappropriate; national courts must assess appropriateness concretely, in light of the risks and of the nature, content and implementation of the measures. The Court added that, in a damages action, the controller bears the burden of proving that its measures were appropriate. Two holdings of that ruling deserve emphasis: in a damages action, it is the controller that must prove its security measures were appropriate, and the fear of seeing one’s data misused by third parties following a breach of the Regulation can by itself amount to non-material damage (CJEU, 14 December 2023, C-340/21). Applied to our facts with the caution they still require: if customer data was in fact accessed, the retailer would have to demonstrate the quality of its security, and the anxiety of customers waiting to learn whether their data will be leaked could itself count as damage, provided an infringement of the Regulation is established.

French criminal law runs in parallel and targets the perpetrators, not the retailer. Whoever fraudulently enters or remains in an automated data system faces prosecution: Article 323-1 of the French Criminal Code states that « Le fait d’accéder ou de se maintenir, frauduleusement, dans tout ou partie d’un système de traitement automatisé de données est puni de trois ans d’emprisonnement et de 100 000 € d’amende. » (Fraudulently accessing or remaining in all or part of an automated data processing system is punished by three years’ imprisonment and a fine of 100,000 euros.) Extracting, holding, reproducing or transmitting the data thus reached is punished separately: Article 323-3 of the same Code states that « Le fait d’introduire frauduleusement des données dans un système de traitement automatisé, d’extraire, de détenir, de reproduire, de transmettre, de supprimer ou de modifier frauduleusement les données qu’il contient est puni de cinq ans d’emprisonnement et de 150 000 € d’amende. » (Fraudulently introducing data into an automated processing system, or fraudulently extracting, holding, reproducing, transmitting, deleting or modifying the data it contains, is punished by five years’ imprisonment and a fine of 150,000 euros.) As for a ransom-style message conditioning the absence of a leak on the company making contact, it could, if the facts are confirmed, be examined as extortion, which Article 312-1 of the Criminal Code defines as follows: « L’extorsion est le fait d’obtenir par violence, menace de violences ou contrainte soit une signature, un engagement ou une renonciation, soit la révélation d’un secret, soit la remise de fonds, de valeurs ou d’un bien quelconque. » (Extortion is the obtaining, by violence, threat of violence or coercion, of a signature, a commitment or a waiver, the revelation of a secret, or the handing over of funds, valuables or any property.) Where personal data was gathered by deception, a further provision may apply: Article 226-18 of the Criminal Code states that « Le fait de collecter des données à caractère personnel par un moyen frauduleux, déloyal ou illicite est puni de cinq ans d’emprisonnement et de 300 000 euros d’amende. » (Fraudulently, unfairly or unlawfully collecting personal data is punished by five years’ imprisonment and a fine of 300,000 euros.) Victims living in France can report the facts to the police or the gendarmerie, in person or in writing, keeping copies of everything; in Paris, reports can be filed at any police station (commissariat) or directly with the public prosecutor (procureur de la République) of the Paris judicial court. A criminal complaint does not replace the steps under data-protection law, but it creates an official record and allows investigators to act while traces are fresh. It also preserves the victim’s civil claim: Article 2 of the Code of Criminal Procedure provides that a civil action for compensation for damage caused by a crime or lesser offence « appartient à tous ceux qui ont personnellement souffert du dommage directement causé par l’infraction » (belongs to all those who have personally suffered damage directly caused by the offence).

B. Complaining to the CNIL and claiming compensation before the court of your home town

The complaint to the supervisory authority is the natural next step when the retailer stays silent or answers inadequately. Article 77(1) of the General Data Protection Regulation gives everyone the right to complain to a supervisory authority, in particular in the country of their habitual residence, their place of work or the place of the alleged breach A person living in France therefore complains to the CNIL, online through the CNIL complaints service, and the authority must keep the complainant informed of the progress and outcome. To give the complaint its full weight, attach the chronology, the screenshots of the notification, the written request sent to the retailer’s data protection officer, any reply received, and, where relevant, the criminal complaint receipt. The CNIL answers questions about when a breach must be notified to it and can investigate, order compliance, and impose administrative fines. Its intervention is collective: it sanctions the controller and protects the public, but it does not award you individual compensation.

Compensation is the business of the courts, and European law sends you to the court closest to you. Article 79(2) of the Regulation allows proceedings against a controller or processor to be brought either before the courts of the country where that controller or processor is established or before the courts of the country where the affected person habitually lives A customer habitually resident in France may therefore sue in France, for example before the judicial court (tribunal judiciaire) of Paris if that is the competent court for the dispute, without having to litigate in the retailer’s home country. The substantive right is stated in Article 82(1): anyone who suffers material or non-material damage as a result of a breach of the Regulation is entitled to compensation from the controller or processor responsible Both the retailer and, where it failed in its own duties or disobeyed instructions, the IT provider can be liable, and each can be held liable for the whole damage so that the victim is effectively compensated.

Two judgments frame what victims must prove and what they can obtain. In its judgment of 4 May 2023 in case C-300/21, the Court of Justice held, first, that a mere breach of the Regulation is not enough without proven damage, and second, that national courts may not require non-material damage to reach a minimum degree of seriousness before compensating it; the amount is then set under national rules, subject to the European principles of equivalence and effectiveness (CJEU, 4 May 2023, C-300/21). There is no minimum gravity threshold, but there must be genuine harm: documented anxiety while waiting to know whether banking details will leak, time spent securing accounts, fraudulent debits, or the concrete misuse of the data. Combined with the C-340/21 ruling quoted above, which accepts that fear of misuse can itself constitute non-material damage, the framework is balanced: honest claims supported by evidence can succeed, while purely theoretical claims cannot. French civil liability completes the picture, since Article 1240 of the Civil Code states that « Tout fait quelconque de l’homme, qui cause à autrui un dommage, oblige celui par la faute duquel il est arrivé à le réparer. » (Any act of man which causes damage to another obliges the person by whose fault it occurred to repair it.) Keep every receipt, every bank statement showing a disputed debit, every hour billed for securing your accounts, and every medical note if the anxiety required care: compensation follows proof, and proof starts on the first day.

Time limits must be watched from the outset. Compensation claims under ordinary French civil law are subject to a five-year period: Article 2224 of the Civil Code provides that « Les actions personnelles ou mobilières se prescrivent par cinq ans à compter du jour où le titulaire d’un droit a connu ou aurait dû connaître les faits lui permettant de l’exercer. » (Personal or movable actions are time-barred after five years from the day on which the holder of a right knew or should have known the facts enabling him to exercise it.) The starting point is therefore the day you actually learned, or should have learned, that your data was affected, which in an incident like this one may be later than the day of the notification itself, since the scope of any leak remains unconfirmed. Do not let that relative comfort make you passive: evidence disperses, application logs are overwritten, and witnesses forget. People living in Paris and the Île-de-France region benefit from proximity to the CNIL’s Paris offices for guidance and to the Paris judicial court for proceedings, but the procedure is the same everywhere in France, and the first steps, securing accounts, writing to the data protection officer, preserving evidence, are identical whether you live in Paris, Lyon, Marseille or a village. Act early, write everything down, and let the facts, not rumour, dictate the next move.

Conclusion

A threatening notification pushed to customers’ telephones is a serious signal and a reason to act, not a verdict. At the date of writing, no official source and no statement from the company has confirmed any intrusion, any theft of customer data or any leak; the retailer’s silence, reported by the press, is a fact, while the hack itself remains a claim by an anonymous sender. No responsibility is established, the contracts between the retailer and its customers take precedence over any general analysis, and only a court can attribute liability. What European and French law already give you is a method: secure your accounts today without clicking links from the incident’s wake, exercise your rights in writing against the retailer’s data protection officer, require the 72-hour notification machinery to do its work through the CNIL, report extortion and intrusion to the criminal authorities, complain to the CNIL if answers do not come, and, where real damage is proved, claim compensation before the court of your habitual residence, with the Court of Justice’s rulings on non-material damage and the burden of proof on your side. Follow that order, keep every document, and judge the situation on confirmed facts as they emerge, not on the fear the message was designed to create.