On the morning of Tuesday 6 October 2026, shoppers who had installed the mobile app of a British online fashion retailer woke to a threatening push notification, according to live reporting by Sky News and by The Independent. The message, as reproduced by The Independent, is addressed to the retailer’s data-protection team and claims that a cloud data-platform instance holding customer information has been fully compromised. It demands that the company make contact and threatens to leak the data. At the time of writing, the retailer had not publicly answered the claim, The Independent reports, while Sky News notes website problems shortly before 10am UK time and a fall of about 5% in the company’s shares. Figures attributed by The Independent to the company itself put its customer base at 17 million shoppers a year across more than 150 countries.<\/p>\n
Strict reservations come before anything else, because they shape every paragraph below. At the drafting date, no official source \u2014 no statement from the company, no decision of a data-protection authority, no court ruling \u2014 has established that any intrusion, data theft or concrete harm actually occurred. The British press itself writes that the retailer “appears” to have been hacked, and an appearance is not a finding. Nothing in this article attributes liability to anyone, describes any company as guilty of anything, or treats the threatening message as proof of a breach. What follows is general legal information for readers in France: the retailer operates a French-language storefront and delivers to France, so residents of France may be among the recipients of the message, and European data-protection law applies to their data. Your signed contracts and the retailer’s terms remain the governing documents for your own orders, and only a court, on full evidence, decides liability. A few French terms will recur, each explained once: a violation de donn\u00e9es \u00e0 caract\u00e8re personnel<\/em> (personal data breach), the d\u00e9l\u00e9gu\u00e9 \u00e0 la protection des donn\u00e9es<\/em> (data protection officer, DPO), the autorit\u00e9 de contr\u00f4le<\/em> (supervisory authority, in France the CNIL), the personne concern\u00e9e<\/em> (the data subject, meaning you), the responsable du traitement<\/em> (the controller, the company deciding why and how data is processed), and the sous-traitant<\/em> (the processor acting on the controller’s behalf).<\/p>\n The starting point is narrow: two newsrooms describing the same morning. Sky News runs the story as breaking news, timestamped Tuesday 6 October 2026 at 10:18 UK time, telling customers that the retailer “has been hacked”, with a live blog tracking the company’s shares, website issues reported shortly before 10am, and customer reactions. The Independent, publishing at 05:13 Eastern time the same day, reports that “everyone with app seemingly sent alarming threat” and reproduces the substance of the message: it is addressed to the retailer’s DPO and IT staff, asserts a full compromise of a data-platform instance, invites engagement, and points to an external chat channel. The Independent adds two glosses that matter for readers without a legal background. First, DPO means the data protection officer, the person appointed inside a company to take responsibility for safeguarding customer information. Second, the platform named in the message is an online data service used by a wide range of companies to store and analyse large datasets. The same article states plainly that the retailer did not immediately respond to a request for comment and had posted nothing about the notification or a possible attack on its social accounts.<\/p>\n Every element beyond those reported sentences belongs to the conditional. If the message genuinely came from inside the retailer’s notification system, that would suggest that attackers reached at least the push-notification channel, which would be serious but would not by itself prove that order histories, passwords or payment data were copied. If the message was spoofed or injected from outside, customers may have received a frightening text while no customer data moved at all. A third possibility, familiar to incident-response teams, is a staged claim: real access to one system, exaggerated into a claim of total compromise to force a ransom negotiation. The press coverage keeps the same caution<\/a> \u2014 “appears to have been hacked”, “suggesting a possible compromise” \u2014 and your reading should keep it too. The scale figures circulating with the story deserve the same treatment: 17 million annual customers in more than 150 countries is a company figure relayed by The Independent, not an official count of people affected, and nothing in the public reporting says how many app users received the notification, which countries they live in, or which categories of data, if any, were accessed. Treating an unconfirmed claim as an established breach would be exactly the mistake that loses cases later: compensation, complaints and even criminal proceedings all require proof of concrete facts, as the second part of this article explains.<\/p>\n One practical consequence follows for readers in France. Because the retailer sells through a French-language storefront with delivery to France, a resident of France who shops there is a personne concern\u00e9e<\/em> whose data is processed in connection with goods offered on the French market. European data-protection rules therefore frame the response even though the news broke abroad. That does not mean French law presumes a breach occurred; it means that if a breach affecting your data is ever established, the tools described below \u2014 the DPO request, the access request, the complaint (plainte<\/em>) to the CNIL, and the damages action (r\u00e9paration du pr\u00e9judice<\/em>) before the French courts \u2014 are the ones available to you. The rest of this first part deals with the hours after the message: how to check whether you are at risk without clicking on anything the message tells you to click.<\/p>\n The golden rule of the first hours is simple: the message itself is untrusted, whatever it claims. A notification that tells you to follow a link, join a chat channel or contact an address may come from attackers, and even a genuine company alert can be copied within hours by opportunists riding the news cycle. Do not tap the link, do not join the channel, and do not reply with personal details. Instead, verify through paths you choose yourself: type the retailer’s web address manually in your browser, open the app through your phone’s official store listing rather than through any in-message button, and check the company’s official social accounts for a statement. If no statement exists, that absence is itself information \u2014 it confirms that nothing official has been said \u2014 but it proves nothing about the underlying claim in either direction.<\/p>\n Second, secure the account on your own initiative, on the assumption that caution costs nothing. Change the password to one that is long, unique to that retailer, and stored in a password manager; activate two-factor authentication if the account offers it; review active sessions and disconnect unknown devices; and check whether the same password was reused on other services, starting with your email account, because a leaked password only becomes dangerous when it opens a second door. If you paid by card, read your statements line by line for the coming weeks rather than waiting for your bank to react, and keep the bank’s card-blocking number at hand. None of these steps concedes that a breach occurred; they are the standard hygiene that lawyers and the CNIL recommend whenever an account-related scare arises, and they cost far less than an identity-theft cleanup.<\/p>\n Third, expect and deflect the second wave: phishing. After every widely reported retail incident, fraudulent emails and text messages appear within days, often better crafted than the original claim because the attackers reuse real order details. Treat any message invoking the incident \u2014 refund offers, “secure your account” links, delivery-fee requests \u2014 as suspicious by default. A retailer communicating properly about a breach would describe the nature of the incident in clear and simple terms and would never ask you to confirm a password or full card number through a link; that expectation comes straight from the GDPR’s transparency duties discussed below. Preserve evidence while you are at it: keep screenshots of the notification with the visible time, save any related emails with full headers, and write down, the same day, which personal details you shared with the retailer over time (name, postal and email addresses, phone number, order history, and whether full or partial payment details were stored). If you later need to show a court or the CNIL what you were exposed to, contemporaneous notes carry far more weight than reconstructions months afterwards. Finally, consider exercising your right of access early: asking the DPO what data the company holds about you establishes a dated baseline, and as a Paris court recalled in a 2025 data-protection judgment, the GDPR’s principles of lawfulness, data minimisation and storage limitation bind every controller regardless of the headlines of the day.<\/p>\n European law starts with a definition that is broader than most shoppers imagine. Article 4(12) of Regulation (EU) 2016\/679, the General Data Protection Regulation, defines the event in the very words recalled by the Lyon Court of Appeal (18 September 2026, no. 23\/06069, full text on courdecassation.fr<\/a>): \u00ab Une violation de la s\u00e9curit\u00e9 entra\u00eenant, de mani\u00e8re accidentelle ou illicite, la destruction, la perte, l’alt\u00e9ration, la divulgation non autoris\u00e9e de donn\u00e9es \u00e0 caract\u00e8re personnel transmises, conserv\u00e9es ou trait\u00e9es d’une autre mani\u00e8re, ou l’acc\u00e8s non autoris\u00e9 \u00e0 de telles donn\u00e9es \u00bb (“personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed). In plain terms, a breach is not only a confirmed theft: an unauthorised access, an accidental loss or an alteration counts, even before anyone proves the data was exploited. That breadth matters here because the claim relayed by the press speaks of a compromised data-platform instance, which, if ever established, would fall squarely inside this definition.<\/p>\n The same regulation then imposes a double notification duty, and the two halves protect different people. First, the controller must warn the authority: \u00ab En cas de violation de donn\u00e9es \u00e0 caract\u00e8re personnel, le responsable du traitement en notifie la violation en question \u00e0 l’autorit\u00e9 de contr\u00f4le comp\u00e9tente conform\u00e9ment \u00e0 l’article 55, dans les meilleurs d\u00e9lais et, si possible, 72 heures au plus tard apr\u00e8s en avoir pris connaissance, \u00e0 moins que la violation en question ne soit pas susceptible d’engendrer un risque pour les droits et libert\u00e9s des personnes physiques. \u00bb (In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the breach to the competent supervisory authority, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.) The French CNIL phrases the operational rule identically on its breach-notification page<\/a>: notification \u00ab dans les meilleurs d\u00e9lais \u00bb (as soon as possible) after a breach presenting a risk to people’s rights and freedoms is found, if possible with an initial filing \u00ab dans un d\u00e9lai de 72 heures \u00bb (within 72 hours), followed by a fuller notification once investigations complete. The strict 72-hour duty itself comes from Article 33 as recalled by the Lyon Court of Appeal (18 September 2026, no. 23\/06069<\/a>). Note what this duty implies for the present story: notification runs from awareness of a breach, not from press coverage of a claim, and a company that has genuinely become aware must act within hours. Conversely, silence from the authority proves nothing on its own, since the clock only starts on established awareness.<\/p>\n Second, the controller may have to warn you directly. Article 34(1), as recalled by the Lyon Court of Appeal (18 September 2026, no. 23\/06069<\/a>), states: \u00ab Lorsqu’une violation de donn\u00e9es \u00e0 caract\u00e8re personnel est susceptible d’engendrer un risque \u00e9lev\u00e9 pour les droits et libert\u00e9s d’une personne physique, le responsable du traitement communique la violation de donn\u00e9es \u00e0 caract\u00e8re personnel \u00e0 la personne […] dans les meilleurs d\u00e9lais. \u00bb (When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the breach to the data subject without undue delay.) That communication must describe the breach in clear and simple terms and give at least the contact point, the likely consequences and the measures taken \u2014 and the notification to the authority must itself identify the \u00ab d\u00e9l\u00e9gu\u00e9 \u00e0 la protection des donn\u00e9es \u00bb (data protection officer) or another contact point for further information. This is why the breakout searches around “DPO” are legally literate: the DPO’s contact details are the hinge of the whole transparency system. If you shop from France, write to the DPO in a traceable way, ask for confirmation of whether your data is affected, which categories are concerned, and what mitigation the company has deployed, and exercise your right of access to obtain a copy of the data held about you. A judgment of the Paris judicial court of 13 February 2025 (RG 21\/07085, full text on courdecassation.fr<\/a>) usefully recalled the framework every such request sits in: personal data must be \u00ab trait\u00e9es de fa\u00e7on \u00e0 garantir une s\u00e9curit\u00e9 appropri\u00e9e des donn\u00e9es \u00e0 caract\u00e8re personnel, y compris la protection contre le traitement non autoris\u00e9 ou illicite et contre la perte, la destruction ou les d\u00e9g\u00e2ts d’origine accidentelle, \u00e0 l’aide de mesures techniques ou organisationnelles appropri\u00e9es (int\u00e9grit\u00e9 et confidentialit\u00e9) \u00bb (processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures \u2014 integrity and confidentiality).<\/p>\n If the answers are missing, late or evasive, the complaint to the authority is your next lever. Article 77(1) of the GDPR gives every data subject the right to lodge a \u00ab r\u00e9clamation aupr\u00e8s d\u2019une autorit\u00e9 de contr\u00f4le \u00bb (complaint with a supervisory authority), in particular in the Member State of his or her \u00ab r\u00e9sidence habituelle \u00bb (habitual residence), place of work or place of the alleged infringement, whenever the person considers that the processing of his or her personal data infringes the Regulation. For a resident of France, that authority is the CNIL, and the complaint can target processing linked to goods offered to you in France. A complaint does not require you to prove the full breach on day one: you describe what you received, when, on which device, what the company answered, and what you ask the authority to examine. The CNIL then informs complainants of the progress and outcome, including the possibility of going to court if the authority mishandles the file \u2014 a procedural safety net many shoppers overlook. Readers who want the broader French picture of breach responses, in French, can consult the related analysis of what to do after personal data is compromised: complaint, CNIL referral and compensation<\/a>, which covers the same reflexes in a domestic cyberattack context.<\/p>\n Compensation is where expectations most often collide with the case law, so the rule must be stated first and without softening: a breach, even an established one, does not automatically equal money. Article 82(1) of the GDPR, in the terms recalled by the Court of Cassation (Social Chamber, 24 June 2026, no. 24-22.792<\/a>), states: \u00ab toute personne ayant subi un dommage mat\u00e9riel ou moral du fait d’une violation du pr\u00e9sent r\u00e8glement a le droit d’obtenir du responsable du traitement ou du sous-traitant r\u00e9paration du pr\u00e9judice subi. \u00bb (Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.) Three cumulative conditions sit inside that single sentence: an infringement of the regulation, a concrete material or moral damage, and a causal link between the two. The Court of Justice of the European Union confirmed the first consequence in its judgment of 4 May 2023, case C-300\/21, \u00d6sterreichische Post, as reported by the Court of Cassation (Social Chamber, 24 June 2026, no. 24-22.792<\/a>): \u00ab la simple violation des dispositions de ce r\u00e8glement ne suffit pas pour conf\u00e9rer un droit \u00e0 r\u00e9paration \u00bb (the mere infringement of the provisions of the Regulation is not sufficient to confer a right to compensation). The same judgment adds two balancing points that French courts now apply routinely: national law may not impose a seriousness threshold on moral damage, but the amount of damages is set under each Member State’s own compensatory rules, subject to the EU principles of equivalence and effectiveness.<\/p>\n The French Court of Cassation drew the operational conclusion weeks ago. In its judgment of 24 June 2026, Social Chamber, appeal no. 24-22.792 (full text on courdecassation.fr<\/a>), the Court quashed a court-of-appeal decision that had awarded 5,000 euros for a GDPR violation without examining actual harm, holding that \u00ab la simple violation du r\u00e8glement g\u00e9n\u00e9ral sur la protection des donn\u00e9es n’ouvre pas, \u00e0 elle seule, droit \u00e0 r\u00e9paration et qu’il lui appartenait d’appr\u00e9cier si le salari\u00e9 \u00e9tablissait que la violation de ce r\u00e8glement qu’elle avait constat\u00e9e avait caus\u00e9 au salari\u00e9 un dommage mat\u00e9riel ou moral \u00bb (the mere violation of the General Data Protection Regulation does not, on its own, open a right to compensation, and the court had to assess whether the employee showed that the established violation had caused him material or moral damage). The Court of Justice reinforced the point on 25 January 2024 in case C-687\/21: the damages remedy serves a compensatory function, in that a pecuniary award \u00ab doit permettre de compenser int\u00e9gralement le pr\u00e9judice concr\u00e8tement subi du fait de la violation de ce r\u00e8glement, et non une fonction punitive \u00bb (must allow full compensation of the harm actually suffered as a result of the infringement, and has no punitive function). Translated into litigation strategy, this means the claimant who only waves a press article loses, while the claimant who documents fraudulent debits, replacement costs, time verifiably spent, professional consequences, or medically attested anxiety can seek full reparation of the proven loss. French civil law runs alongside the European remedy: Article 1240 of the Civil Code provides that \u00ab Tout fait quelconque de l’homme, qui cause \u00e0 autrui un dommage, oblige celui par la faute duquel il est arriv\u00e9 \u00e0 le r\u00e9parer. \u00bb (Any act whatever of man which causes damage to another obliges him by whose fault it occurred to repair it; see Article 1240 on L\u00e9gifrance<\/a>). Keep every receipt, every bank statement, every timestamped exchange with the DPO, and any certificate describing sleep loss or distress if a health professional observes it \u2014 judges compensate files, not feelings.<\/p>\n Procedure, happily, favours the French resident. Article 79(1) of the GDPR, in the full wording reproduced by the Rennes Court of Appeal (7th Labour Chamber, 27 February 2025, no. 24\/02772<\/a>), gives \u00ab chaque personne concern\u00e9e a droit \u00e0 un recours juridictionnel effectif si elle consid\u00e8re que les droits que lui conf\u00e8re le pr\u00e9sent r\u00e8glement ont \u00e9t\u00e9 viol\u00e9s du fait d’un traitement de ses donn\u00e9es \u00e0 caract\u00e8re personnel effectu\u00e9 en violation du pr\u00e9sent r\u00e8glement \u00bb (each data subject has the right to an effective judicial remedy where he or she considers that his or her rights under the Regulation have been infringed as a result of processing of his or her personal data in non-compliance with the Regulation), and Article 79(2) adds that \u00ab Une telle action peut aussi \u00eatre intent\u00e9e devant les juridictions de l’\u00c9tat membre dans lequel la personne concern\u00e9e a sa r\u00e9sidence habituelle \u00bb (such proceedings may also be brought before the courts of the Member State where the data subject has his or her habitual residence). A shopper living in France could therefore, if the conditions were ever met, bring the retailer before the French courts \u2014 typically the tribunal judiciaire<\/em> \u2014 rather than litigating abroad, subject to the usual rules on whom exactly to sue where the corporate structure spans several countries. Send a formal letter of demand (mise en demeure<\/em>) first, quantifying each head of loss with exhibits; courts read pre-action correspondence closely, and a reasoned refusal or silence frames the later debate.<\/p>\n Finally, the criminal dimension exists and should be weighed calmly rather than brandished. Article 226-17 of the French Criminal Code punishes \u00ab Le fait de proc\u00e9der ou de faire proc\u00e9der \u00e0 un traitement de donn\u00e9es \u00e0 caract\u00e8re personnel sans mettre en oeuvre les mesures prescrites aux articles 24,25,30 et 32 du r\u00e8glement (UE) 2016\/679 du 27 avril 2016 pr\u00e9cit\u00e9 \u00bb of \u00ab cinq ans d’emprisonnement et de 300 000 euros d’amende \u00bb (carrying out, or having carried out, personal-data processing without implementing the measures required by Articles 24, 25, 30 and 32 of Regulation (EU) 2016\/679 is punishable by five years’ imprisonment and a 300,000-euro fine; see Article 226-17 on L\u00e9gifrance<\/a>). That offence targets the failure to implement required security measures and would, if the facts ever supported it, allow a victim to file a criminal complaint (plainte p\u00e9nale<\/em>) and join the proceedings as a civil party. Neighbouring offences complete the picture, always on the same conditional basis. Article 226-22 punishes \u00ab Le fait, par toute personne qui a recueilli, \u00e0 l’occasion de leur enregistrement, de leur classement, de leur transmission ou d’une autre forme de traitement, des donn\u00e9es \u00e0 caract\u00e8re personnel dont la divulgation aurait pour effet de porter atteinte \u00e0 la consid\u00e9ration de l’int\u00e9ress\u00e9 ou \u00e0 l’intimit\u00e9 de sa vie priv\u00e9e, de porter, sans autorisation de l’int\u00e9ress\u00e9, ces donn\u00e9es \u00e0 la connaissance d’un tiers qui n’a pas qualit\u00e9 pour les recevoir \u00bb of \u00ab cinq ans d’emprisonnement et de 300 000 euros d’amende \u00bb (disclosing, without the data subject’s authorisation, personal data whose revelation would harm the person’s reputation or private life to a third party not entitled to receive it is punishable by five years’ imprisonment and a 300,000-euro fine; see Article 226-22 on L\u00e9gifrance<\/a>) \u2014 the provision that would matter if leaked customer data were ever published. Article 226-18 punishes \u00ab Le fait de collecter des donn\u00e9es \u00e0 caract\u00e8re personnel par un moyen frauduleux, d\u00e9loyal ou illicite \u00bb of \u00ab cinq ans d’emprisonnement et de 300 000 euros d’amende \u00bb (collecting personal data by fraudulent, unfair or unlawful means; see Article 226-18 on L\u00e9gifrance<\/a>), which is the natural criminal frame for the phishing messages that typically follow a publicised scare. Article 226-16 covers processing carried out without the preliminary formalities required by law (see Article 226-16 on L\u00e9gifrance<\/a>), and Article 226-23 allows the court to order erasure of all or part of the data concerned, with CNIL officers empowered to verify that erasure (see Article 226-23 on L\u00e9gifrance<\/a>). It is quoted here for completeness, not as a prediction: no established facts currently support any criminal characterisation of the notification episode, and only an investigation could ever say otherwise. The same caution governs the regulator’s side \u2014 the CNIL can issue warnings, injunctions and fines under its corrective powers \u2014 but sanctions belong to the authority’s assessment, not to shoppers’ expectations.<\/p>\n A threatening in-app message is a reason to act, not a reason to conclude. Check the alert through official channels you open yourself, lock down the account, watch your statements, preserve dated evidence, write to the DPO, and, if the responses disappoint, complain to the CNIL and prepare a documented damages file for the French courts \u2014 each step conditional on facts that, at the drafting date, remain unestablished by any official source. No intrusion, no data theft and no harm have been officially found; no liability has been attributed to anyone; your contracts govern your orders; and only a judge, on complete evidence, decides whether an infringement, a damage and a causal link coincide. Handled that way, the scare of 6 October becomes what data-protection law wants every scare to become: a tested account, a paper trail, and rights that are ready if the worst is ever proven.<\/p>\n","protected":false},"excerpt":{"rendered":" A threatening notification pushed through a British fashion retailer’s app claims customer data was compromised. If you shop from France, here is how to verify the alert and which GDPR rights – DPO request, CNIL complaint, court damages – you can actually use.<\/p>\n","protected":false},"author":251031309,"featured_media":4156,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_kj_source_type":"","_kj_official_id":"","_kj_official_url":"","_kj_judilibre_id":"","_kj_jur":"","_kj_lieu":"","_kj_chambre":"","_kj_rg":"","_kj_date":"","activitypub_content_warning":"","activitypub_content_visibility":"","activitypub_max_image_attachments":4,"activitypub_interaction_policy_quote":"anyone","activitypub_status":"federated","footnotes":""},"categories":[80314,80316],"tags":[],"class_list":["post-2140048","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-decryptage","category-numerique-donnees-personnelles"],"yoast_head":"\nI. “Has my account been hacked?”: what the notification says and how to react without making things worse<\/h2>\n
A. What the British press actually reports about the strange notification<\/h3>\n
B. You received the alert in France: the checks to run before you click anything<\/h3>\n
II. Your rights in France if a retailer loses control of your personal data<\/h2>\n
A. Force transparency: the DPO, access to your data, and the complaint to the CNIL<\/h3>\n
B. Claim compensation before the French courts \u2014 and the criminal dimension most shoppers miss<\/h3>\n
Conclusion<\/h2>\n