On the morning of Tuesday 6 October 2026, shoppers in the United Kingdom opened a fashion retailer’s mobile app and found a push notification claiming the company had been “hacked”. According to live reporting by the BBC and The Guardian, the message threatened the disclosure of customer data and directed readers to the Telegram messaging service. As of the date of writing, no intrusion, no data leak and no damage has been established by any official source, the retailer concerned says it is still investigating, and no liability has been determined: only a court can decide those questions, and the contracts and privacy documents accepted by each customer take precedence over any general analysis.<\/p>\n
This guide is written for readers in France who use the app concerned, who received the notification, or who simply shop online with British retailers and wonder what a foreign “hacked” alert changes for them. It explains what the 6 October messages actually show, why French and European data law applies to a retailer based outside the European Union, which evidence to preserve from today, and which remedies exist in France: a subject access request, a complaint to the CNIL (Commission nationale de l’informatique et des libert\u00e9s<\/i>, the French data protection authority), and a compensation claim before the French courts. The developments below are general in scope: they describe the checks and remedies available in any comparable situation and do not assess the situation of the retailer concerned, on which this article makes no finding.<\/p>\nI. Has the Shopping App Really Been Hacked? What the 6 October Alert Shows<\/h2>\n
A. What Did the “Hacked” Push Notification Say?<\/h3>\n
The first question searched by thousands of internet users on 6 October 2026 was straightforward: “has the app been hacked?” The honest answer, on the basis of the sources available at the time of writing, is that nobody outside the company and the alleged attackers knows. What is documented is the alert itself. According to the BBC’s live coverage of 6 October 2026, app users “across the UK” received pop-up messages that “appear to have been sent by hackers”, and the national press reports that the retailer concerned is the London-listed online fashion group ASOS. The message reproduced by both the BBC and The Guardian was addressed to the company data protection officer and IT team, claimed that the cloud environment holding customer data had been fully compromised, and threatened to leak it unless the recipients engaged with the senders. The notification was titled “ASOS hacked” and contained a link sending readers to Telegram. The DPO (d\u00e9l\u00e9gu\u00e9 \u00e0 la protection des donn\u00e9es<\/i>, data protection officer) is the person designated by a company to handle data protection questions, which explains why an extortion message would address that role alongside the IT department.<\/p>\n
Snowflake, the service named in the message, is a cloud platform used to store, process and analyse data, including transactions and customer information such as clothing sizes and body measurements, and it also enables push notifications to customers’ phones, as The Guardian explained on the same day. That technical detail matters because it frames two distinct hypotheses: either the attackers only obtained data stored in that environment, or, as one cyber-security analyst quoted by the BBC put it, sending a push notification through the retailer’s own app would require access to the company’s notification system, which is separate from the Snowflake platform, so proven control of the push channel would suggest broader access. Neither hypothesis has been confirmed. The Guardian reported that the retailer said it was aware of the reports but did not confirm them further, that its investigation was continuing, and that the website and the app appeared to keep operating normally on Tuesday morning. The financial press, relayed by the same coverage, noted that the group’s share price on the London Stock Exchange fell by almost 12% during the day, which reflects market nervousness rather than proof of a breach.<\/p>\n
Three contextual facts help readers keep proportion. First, the BBC’s cyber correspondent observed that it is unusual for a possible breach to surface so publicly: most extortion negotiations happen privately, because attackers generally prefer a discreet payment. A public message designed to frighten customers is, in the words of a security operations manager quoted by The Guardian, “clear public extortion” tactics aimed at forcing a quick negotiation, and its visibility proves nothing about the reality or the scale of any intrusion. Second, the same BBC coverage recalled that the Snowflake name has appeared in previous high-profile incidents involving other companies, including Ticketmaster and Santander, which shows that attackers reuse the same pressure narratives from one target to another. Third, The Guardian placed the episode after a series of cyber incidents that affected well-known British retailers in 2025, including Marks & Spencer, the Co-op and Harrods, with stock shortages reported at the time for two of them. Those precedents explain why shoppers react strongly, but each case turns on its own facts.<\/p>\n
What plays in the company’s favour at this stage must be stated plainly: the retailer is investigating rather than hiding, its sales channels remain online, no authority has announced any finding, and no customer data has been shown to have leaked. Readers should therefore treat the notification as an unconfirmed claim, keep the evidence described in part II below, and beware above all of the aftershock that security professionals unanimously predict after such episodes: targeted phishing emails and text messages impersonating the retailer and inviting customers to reset a password, confirm payment details or claim a refund. Any such message should be regarded with suspicion until the company communicates officially.<\/p>\n
The second group of searches around the incident concerns the applicable law: a British company, a British app, but customers in France. For anyone located in France, the answer is the General Data Protection Regulation, Regulation (EU) 2016\/679, which applies beyond the borders of the Union. Its territorial scope is deliberately broad: the Regulation applies to the processing of personal data of people located in the Union by a controller established outside the Union where the processing relates to offering goods or services to those people in the Union, whether or not payment is required, a rule verified against the official French text of the Regulation during this investigation. A retailer that sells and delivers to customers in France, operates a French-language storefront and ships orders to French addresses therefore processes their data within the scope of that provision, even though it is established in the United Kingdom. Readers can find the official framework on the website of the French authority at cnil.fr, the CNIL<\/a>.<\/p>\n The Regulation assigns symmetrical duties to the two main actors. The responsable du traitement<\/i> (controller), here the retailer that decides why and how customer data is used, must notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to create a risk for the rights and freedoms of individuals. The sous-traitant<\/i> (processor), for example a cloud or messaging provider acting on the retailer’s instructions, must in turn warn the controller of any breach as soon as it becomes aware of it. Where the breach is likely to create a high risk for individuals, the controller must also warn each affected person directly and without undue delay where the breach is likely to create a high risk for their rights and freedoms, describing the nature of the breach in clear and plain terms.<\/p>\n For a shopper residing in France, two provisions organise access to the French authorities and courts. Any person who considers that the processing of their data violates the Regulation may lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, workplace or place of the alleged infringement, where they consider that the processing of their data infringes the Regulation. In France that authority is the CNIL, which receives complaints through its online service at cnil.fr, file a complaint with the CNIL<\/a>. In parallel, to an effective judicial remedy where they consider that their rights under the Regulation have been infringed, and such proceedings may also be brought before the courts of the Member State where they have their habitual residence. A customer living in France can therefore bring the retailer before the French courts, in practice the tribunal judiciaire<\/i> (the general civil court), without having to sue in the United Kingdom. This guide covers only these French and European remedies; it does not set out the parallel British rules that apply to residents of the United Kingdom.<\/p>\n The most urgent searches after a claimed breach are practical: what to do after receiving the hacked notification and “how do I protect my account?” The first reflex is preservation of evidence. Keep the notification itself: take a screenshot showing the message, the date and the time, and note the phone model and app version. Keep every document that proves the customer relationship and its extent: order confirmations, delivery emails, invoices, loyalty programme statements and any previous correspondence with customer service. If the content of an account (sizes, addresses, partial card numbers, purchase history) later appears somewhere it should not, only these contemporaneous records will allow a precise comparison between what the retailer held and what has spread. Screenshots should be stored unedited, ideally with their metadata, and backed up outside the phone.<\/p>\n The second reflex is defensive. Do not click on links received by email or text message inviting you to reset the app password, confirm payment details, check an order or claim a refund in connection with the incident: after every widely reported cyber episode, criminals exploit the publicity to send lookalike messages, as the security professionals quoted by The Guardian warned on 6 October itself. To change a password or check an account, open the retailer’s app or type its address manually instead of following a received link, choose a password that is unique to that account, and activate two-factor authentication where the service offers it. Review bank statements and payment notifications for the coming weeks, and challenge any unknown debit directly with the bank. If identity documents or credentials usable for identity theft were stored in the account, consider filing a report with the police (d\u00e9p\u00f4t de plainte<\/i> at the commissariat or gendarmerie) as soon as a fraudulent use appears, because that report will support every later step. French criminal law gives that report real teeth on both sides. On the attackers\u2019 side, fraudulently accessing or remaining in any part of an automated data system is punishable by three years\u2019 imprisonment and a 100,000 euro fine: \u00ab Le fait d\u2019acc\u00e9der ou de se maintenir, frauduleusement, dans tout ou partie d\u2019un syst\u00e8me de traitement automatis\u00e9 de donn\u00e9es est puni de trois ans d\u2019emprisonnement et de 100 000 \u20ac d\u2019amende. \u00bb (L\u00e9gifrance, Criminal Code article 323-1<\/a>), while fraudulently extracting, holding, reproducing, transmitting, deleting or altering the data it contains carries five years and 150,000 euros: \u00ab Le fait d\u2019introduire frauduleusement des donn\u00e9es dans un syst\u00e8me de traitement automatis\u00e9, d\u2019extraire, de d\u00e9tenir, de reproduire, de transmettre, de supprimer ou de modifier frauduleusement les donn\u00e9es qu\u2019il contient est puni de cinq ans d\u2019emprisonnement et de 150 000 \u20ac d\u2019amende. \u00bb (L\u00e9gifrance, Criminal Code article 323-3<\/a>). On the data holder\u2019s side, failing to implement the security measures required by data law is itself an offence, since \u00ab Le fait de proc\u00e9der ou de faire proc\u00e9der \u00e0 un traitement de donn\u00e9es \u00e0 caract\u00e8re personnel sans mettre en oeuvre les mesures prescrites aux articles 24,25,30 et 32 du r\u00e8glement (UE) 2016\/679 du 27 avril 2016 pr\u00e9cit\u00e9 ou au 6\u00b0 de l’article 4 et aux articles 99 \u00e0 101 de la loi n\u00b0 78-17 du 6 janvier 1978 pr\u00e9cit\u00e9e est puni de cinq ans d’emprisonnement et de 300 000 euros d’amende. \u00bb (Carrying out, or having carried out, personal data processing without implementing the measures prescribed by Articles 24, 25, 30 and 32 of Regulation (EU) 2016\/679 or the cited provisions of French Law No. 78-17 of 6 January 1978 is punishable by five years’ imprisonment and a 300,000 euro fine.), in the official version published on L\u00e9gifrance, Criminal Code article 226-17<\/a>. The same code punishes processing carried out \u00ab sans qu’aient \u00e9t\u00e9 respect\u00e9es les formalit\u00e9s pr\u00e9alables \u00e0 leur mise en oeuvre pr\u00e9vues par la loi \u00bb (without complying with the prior formalities for implementation required by law), in the official version published on L\u00e9gifrance, Criminal Code article 226-16<\/a>, and it punishes anyone who, having collected personal data whose disclosure would harm the reputation of the person concerned or the privacy of their private life, discloses it without authorisation to a third party not entitled to receive it, in the official version published on L\u00e9gifrance, Criminal Code article 226-22<\/a>. A person harmed by such an offence is not confined to the civil courts: \u00ab L’action civile en r\u00e9paration du dommage caus\u00e9 par un crime, un d\u00e9lit ou une contravention appartient \u00e0 tous ceux qui ont personnellement souffert du dommage directement caus\u00e9 par l’infraction. \u00bb (A civil action for compensation for damage caused by a felony, misdemeanor or petty offence belongs to all those who have personally suffered damage directly caused by the offence.), in the official version published on L\u00e9gifrance, Code of Criminal Procedure article 2<\/a>, and \u00ab Toute personne qui se pr\u00e9tend l\u00e9s\u00e9e par un crime ou un d\u00e9lit peut en portant plainte se constituer partie civile devant le juge d’instruction \u00bb (Any person claiming to have been harmed by a felony or misdemeanor may, by filing a complaint, become a civil party before the investigating judge.), in the official version published on L\u00e9gifrance, Code of Criminal Procedure article 85<\/a>, once the conditions set by that article are met.<\/p>\n The third reflex is to exercise the right of access, which the Regulation grants against the controller regardless of whether a breach is confirmed: the right to obtain confirmation of whether personal data concerning them is being processed and, where it is, access to that data together with details of purposes, categories of data, recipients and retention periods. The request, sent to the address indicated in the retailer’s privacy policy, should ask for a copy of the data, the categories of data held, the recipients to whom the data has been disclosed, and the retention periods. A precise access request serves two purposes: it documents what the company holds about the customer today, and any later reply, or absence of reply within one month, becomes part of the file. Readers who prefer to read these steps in French can consult our French-language guide published after a previous large-scale breach affecting a French training body, what to do after the Afpa cyberattack: complaint and compensation<\/a>, whose practical method also applies here.<\/p>\n The fourth reflex is the complaint to the CNIL. A complaint can be filed online directly with the authority, in particular by a person residing in France, and it should attach the preserved evidence: the screenshot of the notification, the access request and any reply, and a short chronology of the facts. The CNIL examines the complaint, may investigate the controller, and informs the complainant of the progress and outcome of the case. A complaint does not by itself award compensation, but it creates an official record, it can trigger corrective measures against the company, and the authority’s findings often prove decisive in a later court action. Where the breach presents a high risk, customers should also expect the direct individual notification described above; its absence, several weeks after a confirmed incident, is itself a fact worth reporting to the authority.<\/p>\n The most commercially sensitive question is also the most searched: whether compensation is available if personal data was leaked European law answers with a genuine right, subject to strict conditions. The compensation rule, as restated by the Cour de cassation, provides that any person who has suffered material or non-material damage as a result of an infringement of data law has the right to receive compensation from the controller or processor: \u00ab Aux termes de ce texte, toute personne ayant subi un dommage mat\u00e9riel ou moral du fait d’une violation du pr\u00e9sent r\u00e8glement a le droit d’obtenir du responsable du traitement ou du sous-traitant r\u00e9paration du pr\u00e9judice subi. \u00bb (Cour de cassation, chambre sociale, 24 June 2026, No. 24-22.792<\/a>). Both financial loss, such as fraudulent debits, and non-material harm, such as anxiety or loss of control over one’s data, can in principle qualify. Compensation is therefore neither automatic nor excluded in advance: everything turns on proof of a real damage caused by a proven violation.<\/p>\n The leading French application of that rule came from the Cour de cassation itself on 24 June 2026. In a case where a court of appeal had awarded an employee 5,000 euros on the sole ground that a breach of data law had necessarily caused him harm, the chamber held that \u00ab la simple violation du r\u00e8glement g\u00e9n\u00e9ral sur la protection des donn\u00e9es n’ouvre pas, \u00e0 elle seule, droit \u00e0 r\u00e9paration \u00bb (the mere infringement of the General Data Protection Regulation does not, by itself, confer a right to compensation.) and quashed the award, because the lower court had failed to check whether the employee proved that the established violation had caused him material or non-material damage (Cour de cassation, chambre sociale, 24 June 2026, No. 24-22.792, Natixis, published in the Bulletin<\/a>). European case law, verified against the official texts during this investigation, adds that no minimum seriousness threshold may be imposed for non-material damage and that the amount of damages is assessed under each Member State’s own rules. In France, the amount is therefore assessed under French damages law, on the basis of proven loss.<\/p>\n A second line of European case law, given in a case that itself arose from a hacker attack on a tax administration, holds that unauthorised access by third parties does not by itself prove that the controller’s security was inadequate, but places the burden of proving appropriate security on the controller, refuses to exonerate a controller merely because hackers caused the damage, and accepts that the fear of potential misuse of one’s data following a breach can by itself constitute non-material damage, without proof of actual misuse such as identity theft. These principles were verified against the official text of the judgment during this investigation. Concretely, a French customer who received the “hacked” notification, who preserves it, who shows real anxiety or concrete precautions taken, and who links that harm to a proven violation by the retailer, holds a legally serious file; a customer who suffered no demonstrable consequence holds, at this stage, a file for monitoring rather than a claim for payment.<\/p>\n Before the French courts, the claim follows the ordinary civil track: jurisdiction at the customer’s place of habitual residence under the provision quoted above, proceedings before the tribunal judiciaire<\/i>, and the general French basis of liability for fault, which provides: \u00ab Tout fait quelconque de l’homme, qui cause \u00e0 autrui un dommage, oblige celui par la faute duquel il est arriv\u00e9 \u00e0 le r\u00e9parer. \u00bb (Any act whatever of man which causes damage to another obliges him by whose fault it occurred to repair it.), in the official version published on L\u00e9gifrance, Civil Code article 1240<\/a>. Negligence suffices: \u00ab Chacun est responsable du dommage qu’il a caus\u00e9 non seulement par son fait, mais encore par sa n\u00e9gligence ou par son imprudence. \u00bb (Everyone is liable for the damage caused not only by his own act but also by his negligence or imprudence.), in the official version published on L\u00e9gifrance, Civil Code article 1241<\/a>, which covers careless security as well as deliberate wrongdoing. Time limits must be watched: personal actions are subject to five years, since \u00ab Les actions personnelles ou mobili\u00e8res se prescrivent par cinq ans \u00e0 compter du jour o\u00f9 le titulaire d’un droit a connu ou aurait d\u00fb conna\u00eetre les faits lui permettant de l’exercer. \u00bb (Personal or movable actions are time-barred after five years from the day on which the holder of a right knew or ought to have known the facts enabling him to exercise it.), in the official version published on L\u00e9gifrance, Civil Code article 2224<\/a>. The clock therefore runs from the moment the customer actually learns of the breach and of their damage, not from the date of the attack itself. One confusion must be avoided: the administrative fines that a supervisory authority can impose, which must be effective, proportionate and dissuasive and can reach up to 20 million euros or, for an undertaking, up to 4% of its total worldwide annual turnover, are paid to the State and never go to the victims; they punish, they do not compensate.<\/p>\n A frightening push notification is not proof of a data breach, and an unconfirmed claim is not a finding of liability. As of 6 October 2026, the only established facts are the messages themselves, as reported by the BBC and The Guardian; the retailer concerned says it is investigating, its services remain online, and no intrusion, no leak and no damage has been established by any official source. For shoppers in France, the method is therefore one of vigilant patience: preserve the notification and the account records from today, distrust any message that exploits the episode to request passwords or payments, exercise the right of access, complain to the CNIL where appropriate, and reserve any compensation claim for damage that can actually be shown, within the five-year period, before the French courts. General explanations never replace the contracts signed with the retailer or an assessment of an individual file, and in case of dispute, only the court decides.<\/p>\n","protected":false},"excerpt":{"rendered":" On 6 October 2026, users of a British online fashion retailer’s app received a push notification claiming the company had been “hacked”. The retailer says it is investigating and nothing has been confirmed. This guide explains, for shoppers in France, what the alert means, which evidence to keep, and which remedies French and EU law provide: access request, CNIL complaint, and compensation before the French courts.<\/p>\n","protected":false},"author":251031309,"featured_media":16464,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_kj_source_type":"","_kj_official_id":"","_kj_official_url":"","_kj_judilibre_id":"","_kj_jur":"","_kj_lieu":"","_kj_chambre":"","_kj_rg":"","_kj_date":"","activitypub_content_warning":"","activitypub_content_visibility":"","activitypub_max_image_attachments":4,"activitypub_interaction_policy_quote":"anyone","activitypub_status":"federated","footnotes":""},"categories":[80314,80316],"tags":[],"class_list":["post-2140136","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-decryptage","category-numerique-donnees-personnelles"],"yoast_head":"\nII. What Can You Do in France If Your Shopping Data May Have Leaked?<\/h2>\n
A. What Should You Do Right Now? Keep Proof, Stay Alert and Use Your Rights<\/h3>\n
B. Can You Obtain Compensation in France? Proof, Fault and Amounts<\/h3>\n
Conclusion<\/h2>\n