On the morning of Tuesday 6 October 2026, shoppers who had installed the mobile app of a British online fashion retailer woke to a threatening push notification, according to live reporting by Sky News and by The Independent. The message, as reproduced by The Independent, is addressed to the retailer’s data-protection team and claims that a cloud data-platform instance holding customer information has been fully compromised. It demands that the company make contact and threatens to leak the data. At the time of writing, the retailer had not publicly answered the claim, The Independent reports, while Sky News notes website problems shortly before 10am UK time and a fall of about 5% in the company’s shares. Figures attributed by The Independent to the company itself put its customer base at 17 million shoppers a year across more than 150 countries.

Strict reservations come before anything else, because they shape every paragraph below. At the drafting date, no official source — no statement from the company, no decision of a data-protection authority, no court ruling — has established that any intrusion, data theft or concrete harm actually occurred. The British press itself writes that the retailer “appears” to have been hacked, and an appearance is not a finding. Nothing in this article attributes liability to anyone, describes any company as guilty of anything, or treats the threatening message as proof of a breach. What follows is general legal information for readers in France: the retailer operates a French-language storefront and delivers to France, so residents of France may be among the recipients of the message, and European data-protection law applies to their data. Your signed contracts and the retailer’s terms remain the governing documents for your own orders, and only a court, on full evidence, decides liability. A few French terms will recur, each explained once: a violation de données à caractère personnel (personal data breach), the délégué à la protection des données (data protection officer, DPO), the autorité de contrôle (supervisory authority, in France the CNIL), the personne concernée (the data subject, meaning you), the responsable du traitement (the controller, the company deciding why and how data is processed), and the sous-traitant (the processor acting on the controller’s behalf).

I. “Has my account been hacked?”: what the notification says and how to react without making things worse

A. What the British press actually reports about the strange notification

The starting point is narrow: two newsrooms describing the same morning. Sky News runs the story as breaking news, timestamped Tuesday 6 October 2026 at 10:18 UK time, telling customers that the retailer “has been hacked”, with a live blog tracking the company’s shares, website issues reported shortly before 10am, and customer reactions. The Independent, publishing at 05:13 Eastern time the same day, reports that “everyone with app seemingly sent alarming threat” and reproduces the substance of the message: it is addressed to the retailer’s DPO and IT staff, asserts a full compromise of a data-platform instance, invites engagement, and points to an external chat channel. The Independent adds two glosses that matter for readers without a legal background. First, DPO means the data protection officer, the person appointed inside a company to take responsibility for safeguarding customer information. Second, the platform named in the message is an online data service used by a wide range of companies to store and analyse large datasets. The same article states plainly that the retailer did not immediately respond to a request for comment and had posted nothing about the notification or a possible attack on its social accounts.

Every element beyond those reported sentences belongs to the conditional. If the message genuinely came from inside the retailer’s notification system, that would suggest that attackers reached at least the push-notification channel, which would be serious but would not by itself prove that order histories, passwords or payment data were copied. If the message was spoofed or injected from outside, customers may have received a frightening text while no customer data moved at all. A third possibility, familiar to incident-response teams, is a staged claim: real access to one system, exaggerated into a claim of total compromise to force a ransom negotiation. The press coverage keeps the same caution — “appears to have been hacked”, “suggesting a possible compromise” — and your reading should keep it too. The scale figures circulating with the story deserve the same treatment: 17 million annual customers in more than 150 countries is a company figure relayed by The Independent, not an official count of people affected, and nothing in the public reporting says how many app users received the notification, which countries they live in, or which categories of data, if any, were accessed. Treating an unconfirmed claim as an established breach would be exactly the mistake that loses cases later: compensation, complaints and even criminal proceedings all require proof of concrete facts, as the second part of this article explains.

One practical consequence follows for readers in France. Because the retailer sells through a French-language storefront with delivery to France, a resident of France who shops there is a personne concernée whose data is processed in connection with goods offered on the French market. European data-protection rules therefore frame the response even though the news broke abroad. That does not mean French law presumes a breach occurred; it means that if a breach affecting your data is ever established, the tools described below — the DPO request, the access request, the complaint (plainte) to the CNIL, and the damages action (réparation du préjudice) before the French courts — are the ones available to you. The rest of this first part deals with the hours after the message: how to check whether you are at risk without clicking on anything the message tells you to click.

B. You received the alert in France: the checks to run before you click anything

The golden rule of the first hours is simple: the message itself is untrusted, whatever it claims. A notification that tells you to follow a link, join a chat channel or contact an address may come from attackers, and even a genuine company alert can be copied within hours by opportunists riding the news cycle. Do not tap the link, do not join the channel, and do not reply with personal details. Instead, verify through paths you choose yourself: type the retailer’s web address manually in your browser, open the app through your phone’s official store listing rather than through any in-message button, and check the company’s official social accounts for a statement. If no statement exists, that absence is itself information — it confirms that nothing official has been said — but it proves nothing about the underlying claim in either direction.

Second, secure the account on your own initiative, on the assumption that caution costs nothing. Change the password to one that is long, unique to that retailer, and stored in a password manager; activate two-factor authentication if the account offers it; review active sessions and disconnect unknown devices; and check whether the same password was reused on other services, starting with your email account, because a leaked password only becomes dangerous when it opens a second door. If you paid by card, read your statements line by line for the coming weeks rather than waiting for your bank to react, and keep the bank’s card-blocking number at hand. None of these steps concedes that a breach occurred; they are the standard hygiene that lawyers and the CNIL recommend whenever an account-related scare arises, and they cost far less than an identity-theft cleanup.

Third, expect and deflect the second wave: phishing. After every widely reported retail incident, fraudulent emails and text messages appear within days, often better crafted than the original claim because the attackers reuse real order details. Treat any message invoking the incident — refund offers, “secure your account” links, delivery-fee requests — as suspicious by default. A retailer communicating properly about a breach would describe the nature of the incident in clear and simple terms and would never ask you to confirm a password or full card number through a link; that expectation comes straight from the GDPR’s transparency duties discussed below. Preserve evidence while you are at it: keep screenshots of the notification with the visible time, save any related emails with full headers, and write down, the same day, which personal details you shared with the retailer over time (name, postal and email addresses, phone number, order history, and whether full or partial payment details were stored). If you later need to show a court or the CNIL what you were exposed to, contemporaneous notes carry far more weight than reconstructions months afterwards. Finally, consider exercising your right of access early: asking the DPO what data the company holds about you establishes a dated baseline, and as a Paris court recalled in a 2025 data-protection judgment, the GDPR’s principles of lawfulness, data minimisation and storage limitation bind every controller regardless of the headlines of the day.

II. Your rights in France if a retailer loses control of your personal data

A. Force transparency: the DPO, access to your data, and the complaint to the CNIL

European law starts with a definition that is broader than most shoppers imagine. Article 4(12) of Regulation (EU) 2016/679, the General Data Protection Regulation, defines the event in the very words recalled by the Lyon Court of Appeal (18 September 2026, no. 23/06069, full text on courdecassation.fr): « Une violation de la sécurité entraînant, de manière accidentelle ou illicite, la destruction, la perte, l’altération, la divulgation non autorisée de données à caractère personnel transmises, conservées ou traitées d’une autre manière, ou l’accès non autorisé à de telles données » (“personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed). In plain terms, a breach is not only a confirmed theft: an unauthorised access, an accidental loss or an alteration counts, even before anyone proves the data was exploited. That breadth matters here because the claim relayed by the press speaks of a compromised data-platform instance, which, if ever established, would fall squarely inside this definition.

The same regulation then imposes a double notification duty, and the two halves protect different people. First, the controller must warn the authority: « En cas de violation de données à caractère personnel, le responsable du traitement en notifie la violation en question à l’autorité de contrôle compétente conformément à l’article 55, dans les meilleurs délais et, si possible, 72 heures au plus tard après en avoir pris connaissance, à moins que la violation en question ne soit pas susceptible d’engendrer un risque pour les droits et libertés des personnes physiques. » (In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the breach to the competent supervisory authority, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.) The French CNIL phrases the operational rule identically on its breach-notification page: notification « dans les meilleurs délais » (as soon as possible) after a breach presenting a risk to people’s rights and freedoms is found, if possible with an initial filing « dans un délai de 72 heures » (within 72 hours), followed by a fuller notification once investigations complete. The strict 72-hour duty itself comes from Article 33 as recalled by the Lyon Court of Appeal (18 September 2026, no. 23/06069). Note what this duty implies for the present story: notification runs from awareness of a breach, not from press coverage of a claim, and a company that has genuinely become aware must act within hours. Conversely, silence from the authority proves nothing on its own, since the clock only starts on established awareness.

Second, the controller may have to warn you directly. Article 34(1), as recalled by the Lyon Court of Appeal (18 September 2026, no. 23/06069), states: « Lorsqu’une violation de données à caractère personnel est susceptible d’engendrer un risque élevé pour les droits et libertés d’une personne physique, le responsable du traitement communique la violation de données à caractère personnel à la personne […] dans les meilleurs délais. » (When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the breach to the data subject without undue delay.) That communication must describe the breach in clear and simple terms and give at least the contact point, the likely consequences and the measures taken — and the notification to the authority must itself identify the « délégué à la protection des données » (data protection officer) or another contact point for further information. This is why the breakout searches around “DPO” are legally literate: the DPO’s contact details are the hinge of the whole transparency system. If you shop from France, write to the DPO in a traceable way, ask for confirmation of whether your data is affected, which categories are concerned, and what mitigation the company has deployed, and exercise your right of access to obtain a copy of the data held about you. A judgment of the Paris judicial court of 13 February 2025 (RG 21/07085, full text on courdecassation.fr) usefully recalled the framework every such request sits in: personal data must be « traitées de façon à garantir une sécurité appropriée des données à caractère personnel, y compris la protection contre le traitement non autorisé ou illicite et contre la perte, la destruction ou les dégâts d’origine accidentelle, à l’aide de mesures techniques ou organisationnelles appropriées (intégrité et confidentialité) » (processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures — integrity and confidentiality).

If the answers are missing, late or evasive, the complaint to the authority is your next lever. Article 77(1) of the GDPR gives every data subject the right to lodge a « réclamation auprès d’une autorité de contrôle » (complaint with a supervisory authority), in particular in the Member State of his or her « résidence habituelle » (habitual residence), place of work or place of the alleged infringement, whenever the person considers that the processing of his or her personal data infringes the Regulation. For a resident of France, that authority is the CNIL, and the complaint can target processing linked to goods offered to you in France. A complaint does not require you to prove the full breach on day one: you describe what you received, when, on which device, what the company answered, and what you ask the authority to examine. The CNIL then informs complainants of the progress and outcome, including the possibility of going to court if the authority mishandles the file — a procedural safety net many shoppers overlook. Readers who want the broader French picture of breach responses, in French, can consult the related analysis of what to do after personal data is compromised: complaint, CNIL referral and compensation, which covers the same reflexes in a domestic cyberattack context.

B. Claim compensation before the French courts — and the criminal dimension most shoppers miss

Compensation is where expectations most often collide with the case law, so the rule must be stated first and without softening: a breach, even an established one, does not automatically equal money. Article 82(1) of the GDPR, in the terms recalled by the Court of Cassation (Social Chamber, 24 June 2026, no. 24-22.792), states: « toute personne ayant subi un dommage matériel ou moral du fait d’une violation du présent règlement a le droit d’obtenir du responsable du traitement ou du sous-traitant réparation du préjudice subi. » (Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.) Three cumulative conditions sit inside that single sentence: an infringement of the regulation, a concrete material or moral damage, and a causal link between the two. The Court of Justice of the European Union confirmed the first consequence in its judgment of 4 May 2023, case C-300/21, Österreichische Post, as reported by the Court of Cassation (Social Chamber, 24 June 2026, no. 24-22.792): « la simple violation des dispositions de ce règlement ne suffit pas pour conférer un droit à réparation » (the mere infringement of the provisions of the Regulation is not sufficient to confer a right to compensation). The same judgment adds two balancing points that French courts now apply routinely: national law may not impose a seriousness threshold on moral damage, but the amount of damages is set under each Member State’s own compensatory rules, subject to the EU principles of equivalence and effectiveness.

The French Court of Cassation drew the operational conclusion weeks ago. In its judgment of 24 June 2026, Social Chamber, appeal no. 24-22.792 (full text on courdecassation.fr), the Court quashed a court-of-appeal decision that had awarded 5,000 euros for a GDPR violation without examining actual harm, holding that « la simple violation du règlement général sur la protection des données n’ouvre pas, à elle seule, droit à réparation et qu’il lui appartenait d’apprécier si le salarié établissait que la violation de ce règlement qu’elle avait constatée avait causé au salarié un dommage matériel ou moral » (the mere violation of the General Data Protection Regulation does not, on its own, open a right to compensation, and the court had to assess whether the employee showed that the established violation had caused him material or moral damage). The Court of Justice reinforced the point on 25 January 2024 in case C-687/21: the damages remedy serves a compensatory function, in that a pecuniary award « doit permettre de compenser intégralement le préjudice concrètement subi du fait de la violation de ce règlement, et non une fonction punitive » (must allow full compensation of the harm actually suffered as a result of the infringement, and has no punitive function). Translated into litigation strategy, this means the claimant who only waves a press article loses, while the claimant who documents fraudulent debits, replacement costs, time verifiably spent, professional consequences, or medically attested anxiety can seek full reparation of the proven loss. French civil law runs alongside the European remedy: Article 1240 of the Civil Code provides that « Tout fait quelconque de l’homme, qui cause à autrui un dommage, oblige celui par la faute duquel il est arrivé à le réparer. » (Any act whatever of man which causes damage to another obliges him by whose fault it occurred to repair it; see Article 1240 on Légifrance). Keep every receipt, every bank statement, every timestamped exchange with the DPO, and any certificate describing sleep loss or distress if a health professional observes it — judges compensate files, not feelings.

Procedure, happily, favours the French resident. Article 79(1) of the GDPR, in the full wording reproduced by the Rennes Court of Appeal (7th Labour Chamber, 27 February 2025, no. 24/02772), gives « chaque personne concernée a droit à un recours juridictionnel effectif si elle considère que les droits que lui confère le présent règlement ont été violés du fait d’un traitement de ses données à caractère personnel effectué en violation du présent règlement » (each data subject has the right to an effective judicial remedy where he or she considers that his or her rights under the Regulation have been infringed as a result of processing of his or her personal data in non-compliance with the Regulation), and Article 79(2) adds that « Une telle action peut aussi être intentée devant les juridictions de l’État membre dans lequel la personne concernée a sa résidence habituelle » (such proceedings may also be brought before the courts of the Member State where the data subject has his or her habitual residence). A shopper living in France could therefore, if the conditions were ever met, bring the retailer before the French courts — typically the tribunal judiciaire — rather than litigating abroad, subject to the usual rules on whom exactly to sue where the corporate structure spans several countries. Send a formal letter of demand (mise en demeure) first, quantifying each head of loss with exhibits; courts read pre-action correspondence closely, and a reasoned refusal or silence frames the later debate.

Finally, the criminal dimension exists and should be weighed calmly rather than brandished. Article 226-17 of the French Criminal Code punishes « Le fait de procéder ou de faire procéder à un traitement de données à caractère personnel sans mettre en oeuvre les mesures prescrites aux articles 24,25,30 et 32 du règlement (UE) 2016/679 du 27 avril 2016 précité » of « cinq ans d’emprisonnement et de 300 000 euros d’amende » (carrying out, or having carried out, personal-data processing without implementing the measures required by Articles 24, 25, 30 and 32 of Regulation (EU) 2016/679 is punishable by five years’ imprisonment and a 300,000-euro fine; see Article 226-17 on Légifrance). That offence targets the failure to implement required security measures and would, if the facts ever supported it, allow a victim to file a criminal complaint (plainte pénale) and join the proceedings as a civil party. Neighbouring offences complete the picture, always on the same conditional basis. Article 226-22 punishes « Le fait, par toute personne qui a recueilli, à l’occasion de leur enregistrement, de leur classement, de leur transmission ou d’une autre forme de traitement, des données à caractère personnel dont la divulgation aurait pour effet de porter atteinte à la considération de l’intéressé ou à l’intimité de sa vie privée, de porter, sans autorisation de l’intéressé, ces données à la connaissance d’un tiers qui n’a pas qualité pour les recevoir » of « cinq ans d’emprisonnement et de 300 000 euros d’amende » (disclosing, without the data subject’s authorisation, personal data whose revelation would harm the person’s reputation or private life to a third party not entitled to receive it is punishable by five years’ imprisonment and a 300,000-euro fine; see Article 226-22 on Légifrance) — the provision that would matter if leaked customer data were ever published. Article 226-18 punishes « Le fait de collecter des données à caractère personnel par un moyen frauduleux, déloyal ou illicite » of « cinq ans d’emprisonnement et de 300 000 euros d’amende » (collecting personal data by fraudulent, unfair or unlawful means; see Article 226-18 on Légifrance), which is the natural criminal frame for the phishing messages that typically follow a publicised scare. Article 226-16 covers processing carried out without the preliminary formalities required by law (see Article 226-16 on Légifrance), and Article 226-23 allows the court to order erasure of all or part of the data concerned, with CNIL officers empowered to verify that erasure (see Article 226-23 on Légifrance). It is quoted here for completeness, not as a prediction: no established facts currently support any criminal characterisation of the notification episode, and only an investigation could ever say otherwise. The same caution governs the regulator’s side — the CNIL can issue warnings, injunctions and fines under its corrective powers — but sanctions belong to the authority’s assessment, not to shoppers’ expectations.

Conclusion

A threatening in-app message is a reason to act, not a reason to conclude. Check the alert through official channels you open yourself, lock down the account, watch your statements, preserve dated evidence, write to the DPO, and, if the responses disappoint, complain to the CNIL and prepare a documented damages file for the French courts — each step conditional on facts that, at the drafting date, remain unestablished by any official source. No intrusion, no data theft and no harm have been officially found; no liability has been attributed to anyone; your contracts govern your orders; and only a judge, on complete evidence, decides whether an infringement, a damage and a causal link coincide. Handled that way, the scare of 6 October becomes what data-protection law wants every scare to become: a tested account, a paper trail, and rights that are ready if the worst is ever proven.