On the morning of Tuesday 6 October 2026, shoppers in the United Kingdom opened a fashion retailer’s mobile app and found a push notification claiming the company had been “hacked”. According to live reporting by the BBC and The Guardian, the message threatened the disclosure of customer data and directed readers to the Telegram messaging service. As of the date of writing, no intrusion, no data leak and no damage has been established by any official source, the retailer concerned says it is still investigating, and no liability has been determined: only a court can decide those questions, and the contracts and privacy documents accepted by each customer take precedence over any general analysis.

This guide is written for readers in France who use the app concerned, who received the notification, or who simply shop online with British retailers and wonder what a foreign “hacked” alert changes for them. It explains what the 6 October messages actually show, why French and European data law applies to a retailer based outside the European Union, which evidence to preserve from today, and which remedies exist in France: a subject access request, a complaint to the CNIL (Commission nationale de l’informatique et des libertés, the French data protection authority), and a compensation claim before the French courts. The developments below are general in scope: they describe the checks and remedies available in any comparable situation and do not assess the situation of the retailer concerned, on which this article makes no finding.

I. Has the Shopping App Really Been Hacked? What the 6 October Alert Shows

A. What Did the “Hacked” Push Notification Say?

The first question searched by thousands of internet users on 6 October 2026 was straightforward: “has the app been hacked?” The honest answer, on the basis of the sources available at the time of writing, is that nobody outside the company and the alleged attackers knows. What is documented is the alert itself. According to the BBC’s live coverage of 6 October 2026, app users “across the UK” received pop-up messages that “appear to have been sent by hackers”, and the national press reports that the retailer concerned is the London-listed online fashion group ASOS. The message reproduced by both the BBC and The Guardian was addressed to the company data protection officer and IT team, claimed that the cloud environment holding customer data had been fully compromised, and threatened to leak it unless the recipients engaged with the senders. The notification was titled “ASOS hacked” and contained a link sending readers to Telegram. The DPO (délégué à la protection des données, data protection officer) is the person designated by a company to handle data protection questions, which explains why an extortion message would address that role alongside the IT department.

Snowflake, the service named in the message, is a cloud platform used to store, process and analyse data, including transactions and customer information such as clothing sizes and body measurements, and it also enables push notifications to customers’ phones, as The Guardian explained on the same day. That technical detail matters because it frames two distinct hypotheses: either the attackers only obtained data stored in that environment, or, as one cyber-security analyst quoted by the BBC put it, sending a push notification through the retailer’s own app would require access to the company’s notification system, which is separate from the Snowflake platform, so proven control of the push channel would suggest broader access. Neither hypothesis has been confirmed. The Guardian reported that the retailer said it was aware of the reports but did not confirm them further, that its investigation was continuing, and that the website and the app appeared to keep operating normally on Tuesday morning. The financial press, relayed by the same coverage, noted that the group’s share price on the London Stock Exchange fell by almost 12% during the day, which reflects market nervousness rather than proof of a breach.

Three contextual facts help readers keep proportion. First, the BBC’s cyber correspondent observed that it is unusual for a possible breach to surface so publicly: most extortion negotiations happen privately, because attackers generally prefer a discreet payment. A public message designed to frighten customers is, in the words of a security operations manager quoted by The Guardian, “clear public extortion” tactics aimed at forcing a quick negotiation, and its visibility proves nothing about the reality or the scale of any intrusion. Second, the same BBC coverage recalled that the Snowflake name has appeared in previous high-profile incidents involving other companies, including Ticketmaster and Santander, which shows that attackers reuse the same pressure narratives from one target to another. Third, The Guardian placed the episode after a series of cyber incidents that affected well-known British retailers in 2025, including Marks & Spencer, the Co-op and Harrods, with stock shortages reported at the time for two of them. Those precedents explain why shoppers react strongly, but each case turns on its own facts.

What plays in the company’s favour at this stage must be stated plainly: the retailer is investigating rather than hiding, its sales channels remain online, no authority has announced any finding, and no customer data has been shown to have leaked. Readers should therefore treat the notification as an unconfirmed claim, keep the evidence described in part II below, and beware above all of the aftershock that security professionals unanimously predict after such episodes: targeted phishing emails and text messages impersonating the retailer and inviting customers to reset a password, confirm payment details or claim a refund. Any such message should be regarded with suspicion until the company communicates officially.

B. Why Do French and EU Rules Apply to a British Online Retailer?

The second group of searches around the incident concerns the applicable law: a British company, a British app, but customers in France. For anyone located in France, the answer is the General Data Protection Regulation, Regulation (EU) 2016/679, which applies beyond the borders of the Union. Its territorial scope is deliberately broad: the Regulation applies to the processing of personal data of people located in the Union by a controller established outside the Union where the processing relates to offering goods or services to those people in the Union, whether or not payment is required, a rule verified against the official French text of the Regulation during this investigation. A retailer that sells and delivers to customers in France, operates a French-language storefront and ships orders to French addresses therefore processes their data within the scope of that provision, even though it is established in the United Kingdom. Readers can find the official framework on the website of the French authority at cnil.fr, the CNIL.

The Regulation assigns symmetrical duties to the two main actors. The responsable du traitement (controller), here the retailer that decides why and how customer data is used, must notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to create a risk for the rights and freedoms of individuals. The sous-traitant (processor), for example a cloud or messaging provider acting on the retailer’s instructions, must in turn warn the controller of any breach as soon as it becomes aware of it. Where the breach is likely to create a high risk for individuals, the controller must also warn each affected person directly and without undue delay where the breach is likely to create a high risk for their rights and freedoms, describing the nature of the breach in clear and plain terms.

For a shopper residing in France, two provisions organise access to the French authorities and courts. Any person who considers that the processing of their data violates the Regulation may lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, workplace or place of the alleged infringement, where they consider that the processing of their data infringes the Regulation. In France that authority is the CNIL, which receives complaints through its online service at cnil.fr, file a complaint with the CNIL. In parallel, to an effective judicial remedy where they consider that their rights under the Regulation have been infringed, and such proceedings may also be brought before the courts of the Member State where they have their habitual residence. A customer living in France can therefore bring the retailer before the French courts, in practice the tribunal judiciaire (the general civil court), without having to sue in the United Kingdom. This guide covers only these French and European remedies; it does not set out the parallel British rules that apply to residents of the United Kingdom.

II. What Can You Do in France If Your Shopping Data May Have Leaked?

A. What Should You Do Right Now? Keep Proof, Stay Alert and Use Your Rights

The most urgent searches after a claimed breach are practical: what to do after receiving the hacked notification and “how do I protect my account?” The first reflex is preservation of evidence. Keep the notification itself: take a screenshot showing the message, the date and the time, and note the phone model and app version. Keep every document that proves the customer relationship and its extent: order confirmations, delivery emails, invoices, loyalty programme statements and any previous correspondence with customer service. If the content of an account (sizes, addresses, partial card numbers, purchase history) later appears somewhere it should not, only these contemporaneous records will allow a precise comparison between what the retailer held and what has spread. Screenshots should be stored unedited, ideally with their metadata, and backed up outside the phone.

The second reflex is defensive. Do not click on links received by email or text message inviting you to reset the app password, confirm payment details, check an order or claim a refund in connection with the incident: after every widely reported cyber episode, criminals exploit the publicity to send lookalike messages, as the security professionals quoted by The Guardian warned on 6 October itself. To change a password or check an account, open the retailer’s app or type its address manually instead of following a received link, choose a password that is unique to that account, and activate two-factor authentication where the service offers it. Review bank statements and payment notifications for the coming weeks, and challenge any unknown debit directly with the bank. If identity documents or credentials usable for identity theft were stored in the account, consider filing a report with the police (dépôt de plainte at the commissariat or gendarmerie) as soon as a fraudulent use appears, because that report will support every later step. French criminal law gives that report real teeth on both sides. On the attackers’ side, fraudulently accessing or remaining in any part of an automated data system is punishable by three years’ imprisonment and a 100,000 euro fine: « Le fait d’accéder ou de se maintenir, frauduleusement, dans tout ou partie d’un système de traitement automatisé de données est puni de trois ans d’emprisonnement et de 100 000 € d’amende. » (Légifrance, Criminal Code article 323-1), while fraudulently extracting, holding, reproducing, transmitting, deleting or altering the data it contains carries five years and 150,000 euros: « Le fait d’introduire frauduleusement des données dans un système de traitement automatisé, d’extraire, de détenir, de reproduire, de transmettre, de supprimer ou de modifier frauduleusement les données qu’il contient est puni de cinq ans d’emprisonnement et de 150 000 € d’amende. » (Légifrance, Criminal Code article 323-3). On the data holder’s side, failing to implement the security measures required by data law is itself an offence, since « Le fait de procéder ou de faire procéder à un traitement de données à caractère personnel sans mettre en oeuvre les mesures prescrites aux articles 24,25,30 et 32 du règlement (UE) 2016/679 du 27 avril 2016 précité ou au 6° de l’article 4 et aux articles 99 à 101 de la loi n° 78-17 du 6 janvier 1978 précitée est puni de cinq ans d’emprisonnement et de 300 000 euros d’amende. » (Carrying out, or having carried out, personal data processing without implementing the measures prescribed by Articles 24, 25, 30 and 32 of Regulation (EU) 2016/679 or the cited provisions of French Law No. 78-17 of 6 January 1978 is punishable by five years’ imprisonment and a 300,000 euro fine.), in the official version published on Légifrance, Criminal Code article 226-17. The same code punishes processing carried out « sans qu’aient été respectées les formalités préalables à leur mise en oeuvre prévues par la loi » (without complying with the prior formalities for implementation required by law), in the official version published on Légifrance, Criminal Code article 226-16, and it punishes anyone who, having collected personal data whose disclosure would harm the reputation of the person concerned or the privacy of their private life, discloses it without authorisation to a third party not entitled to receive it, in the official version published on Légifrance, Criminal Code article 226-22. A person harmed by such an offence is not confined to the civil courts: « L’action civile en réparation du dommage causé par un crime, un délit ou une contravention appartient à tous ceux qui ont personnellement souffert du dommage directement causé par l’infraction. » (A civil action for compensation for damage caused by a felony, misdemeanor or petty offence belongs to all those who have personally suffered damage directly caused by the offence.), in the official version published on Légifrance, Code of Criminal Procedure article 2, and « Toute personne qui se prétend lésée par un crime ou un délit peut en portant plainte se constituer partie civile devant le juge d’instruction » (Any person claiming to have been harmed by a felony or misdemeanor may, by filing a complaint, become a civil party before the investigating judge.), in the official version published on Légifrance, Code of Criminal Procedure article 85, once the conditions set by that article are met.

The third reflex is to exercise the right of access, which the Regulation grants against the controller regardless of whether a breach is confirmed: the right to obtain confirmation of whether personal data concerning them is being processed and, where it is, access to that data together with details of purposes, categories of data, recipients and retention periods. The request, sent to the address indicated in the retailer’s privacy policy, should ask for a copy of the data, the categories of data held, the recipients to whom the data has been disclosed, and the retention periods. A precise access request serves two purposes: it documents what the company holds about the customer today, and any later reply, or absence of reply within one month, becomes part of the file. Readers who prefer to read these steps in French can consult our French-language guide published after a previous large-scale breach affecting a French training body, what to do after the Afpa cyberattack: complaint and compensation, whose practical method also applies here.

The fourth reflex is the complaint to the CNIL. A complaint can be filed online directly with the authority, in particular by a person residing in France, and it should attach the preserved evidence: the screenshot of the notification, the access request and any reply, and a short chronology of the facts. The CNIL examines the complaint, may investigate the controller, and informs the complainant of the progress and outcome of the case. A complaint does not by itself award compensation, but it creates an official record, it can trigger corrective measures against the company, and the authority’s findings often prove decisive in a later court action. Where the breach presents a high risk, customers should also expect the direct individual notification described above; its absence, several weeks after a confirmed incident, is itself a fact worth reporting to the authority.

B. Can You Obtain Compensation in France? Proof, Fault and Amounts

The most commercially sensitive question is also the most searched: whether compensation is available if personal data was leaked European law answers with a genuine right, subject to strict conditions. The compensation rule, as restated by the Cour de cassation, provides that any person who has suffered material or non-material damage as a result of an infringement of data law has the right to receive compensation from the controller or processor: « Aux termes de ce texte, toute personne ayant subi un dommage matériel ou moral du fait d’une violation du présent règlement a le droit d’obtenir du responsable du traitement ou du sous-traitant réparation du préjudice subi. » (Cour de cassation, chambre sociale, 24 June 2026, No. 24-22.792). Both financial loss, such as fraudulent debits, and non-material harm, such as anxiety or loss of control over one’s data, can in principle qualify. Compensation is therefore neither automatic nor excluded in advance: everything turns on proof of a real damage caused by a proven violation.

The leading French application of that rule came from the Cour de cassation itself on 24 June 2026. In a case where a court of appeal had awarded an employee 5,000 euros on the sole ground that a breach of data law had necessarily caused him harm, the chamber held that « la simple violation du règlement général sur la protection des données n’ouvre pas, à elle seule, droit à réparation » (the mere infringement of the General Data Protection Regulation does not, by itself, confer a right to compensation.) and quashed the award, because the lower court had failed to check whether the employee proved that the established violation had caused him material or non-material damage (Cour de cassation, chambre sociale, 24 June 2026, No. 24-22.792, Natixis, published in the Bulletin). European case law, verified against the official texts during this investigation, adds that no minimum seriousness threshold may be imposed for non-material damage and that the amount of damages is assessed under each Member State’s own rules. In France, the amount is therefore assessed under French damages law, on the basis of proven loss.

A second line of European case law, given in a case that itself arose from a hacker attack on a tax administration, holds that unauthorised access by third parties does not by itself prove that the controller’s security was inadequate, but places the burden of proving appropriate security on the controller, refuses to exonerate a controller merely because hackers caused the damage, and accepts that the fear of potential misuse of one’s data following a breach can by itself constitute non-material damage, without proof of actual misuse such as identity theft. These principles were verified against the official text of the judgment during this investigation. Concretely, a French customer who received the “hacked” notification, who preserves it, who shows real anxiety or concrete precautions taken, and who links that harm to a proven violation by the retailer, holds a legally serious file; a customer who suffered no demonstrable consequence holds, at this stage, a file for monitoring rather than a claim for payment.

Before the French courts, the claim follows the ordinary civil track: jurisdiction at the customer’s place of habitual residence under the provision quoted above, proceedings before the tribunal judiciaire, and the general French basis of liability for fault, which provides: « Tout fait quelconque de l’homme, qui cause à autrui un dommage, oblige celui par la faute duquel il est arrivé à le réparer. » (Any act whatever of man which causes damage to another obliges him by whose fault it occurred to repair it.), in the official version published on Légifrance, Civil Code article 1240. Negligence suffices: « Chacun est responsable du dommage qu’il a causé non seulement par son fait, mais encore par sa négligence ou par son imprudence. » (Everyone is liable for the damage caused not only by his own act but also by his negligence or imprudence.), in the official version published on Légifrance, Civil Code article 1241, which covers careless security as well as deliberate wrongdoing. Time limits must be watched: personal actions are subject to five years, since « Les actions personnelles ou mobilières se prescrivent par cinq ans à compter du jour où le titulaire d’un droit a connu ou aurait dû connaître les faits lui permettant de l’exercer. » (Personal or movable actions are time-barred after five years from the day on which the holder of a right knew or ought to have known the facts enabling him to exercise it.), in the official version published on Légifrance, Civil Code article 2224. The clock therefore runs from the moment the customer actually learns of the breach and of their damage, not from the date of the attack itself. One confusion must be avoided: the administrative fines that a supervisory authority can impose, which must be effective, proportionate and dissuasive and can reach up to 20 million euros or, for an undertaking, up to 4% of its total worldwide annual turnover, are paid to the State and never go to the victims; they punish, they do not compensate.

Conclusion

A frightening push notification is not proof of a data breach, and an unconfirmed claim is not a finding of liability. As of 6 October 2026, the only established facts are the messages themselves, as reported by the BBC and The Guardian; the retailer concerned says it is investigating, its services remain online, and no intrusion, no leak and no damage has been established by any official source. For shoppers in France, the method is therefore one of vigilant patience: preserve the notification and the account records from today, distrust any message that exploits the episode to request passwords or payments, exercise the right of access, complain to the CNIL where appropriate, and reserve any compensation claim for damage that can actually be shown, within the five-year period, before the French courts. General explanations never replace the contracts signed with the retailer or an assessment of an individual file, and in case of dispute, only the court decides.