ASOS data breach: managing the legal fallout of a cyber-attack

It started with a ping.

Around 10am on 6 October 2026, the sound was heard on hundreds of phones across the UK, which signalled the latest addition to a growing list of high-profile cyber incidents. This time, it was ASOS, the UK-based online fashion and cosmetics retailer, which suffered a data breach after hackers obtained an employee's login credentials through a social engineering attack and used them to access customer information held on third-party platforms.

The incident became public when a notification, sent from the retailer to its app users, read:

"ASOS HACKED: Dear Asos DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it".

Similar alerts reached app users in Australia and France. By 3.30pm the same day, ASOS confirmed that an unauthorised message had been sent to customers through its app and that basic personal information, including name and contact details, may have been compromised. Within hours of the app message, shares in ASOS plc had fallen by almost 10%.

The incident follows cyber-attacks on the Co-op and Marks & Spencer in 2025, both of which reported a significant impact on profits and revenues and, since 6 October, other fashion retailers, including Phase Eight, Hobbs and H&M, have reported separate cyber incidents. Given this latest wave of attacks, it is worth considering the legal and regulatory framework that applies when a personal data breach occurs.

The key lesson is that a breach is not only a security problem: how an organisation prepares for, reports and responds to an incident will shape its regulatory, litigation and reputational exposure.

Legal and regulatory framework

Personal data breaches are governed by the UK GDPR and the Data Protection Act 2018. Article 5(1)(f) and Article 32 UK GDPR require organisations to protect personal data against unauthorised access, accidental loss, destruction or damage by putting appropriate technical and organisational measures in place. In practice, this may include access controls, multi-factor authentication, encryption, staff training and breach response procedures, several of which are discussed in our top tips below.

However, the legal obligations do not end with security measures. Where a personal data breach occurs, organisations must also consider their reporting obligations under the UK GDPR. Article 33 requires a data controller to notify the Information Commission (ICO) of a personal data breach without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless the breach is "unlikely to result in a risk to the rights and freedoms of natural persons". Whether a breach meets this threshold will depend on the circumstances, and controllers must document all breaches (including those not reported) under Article 33(5). Under Article 34, organisations must also notify the affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

Any notification to individuals should be clear and easy to understand, addressing what happened, the information affected and the steps being taken in response. The purpose is to ensure that individuals have enough information to understand any risks arising from the breach and, where necessary, take steps to protect themselves.

The ICO has a range of enforcement powers where it identifies non-compliance with the UK GDPR, including the power to investigate breaches, require organisations to take corrective action and, in the most serious cases, impose administrative fines.

In deciding whether to impose an administrative fine, and the amount of any fine, the ICO must have regard to the factors set out in Article 83(2) UK GDPR, which include:

• the nature and seriousness of the breach
• the categories of personal data affected
• the technical and organisational measures in place prior to the incident
• the steps taken by the organisation to contain, investigate and respond to the breach

Organisations operating in both NI and the ROI should also bear in mind that the EU GDPR and the Irish Data Protection Act 2018 apply to their Irish operations. A single incident affecting UK and Irish customers may therefore require separate notifications to the ICO and the Data Protection Commission, each within 72 hours, and expose the organisation to enforcement and claims in both jurisdictions.

What risks can arise from this kind of incident?

Individuals whose personal data has been affected by a breach can complain to the ICO and, separately, may be entitled to claim compensation where they have suffered material or non-material damage. Claims can be brought for breaches of data protection legislation, misuse of private information or breach of confidence.

While some claims relate solely to financial loss, other claims are based on the distress resulting from personal data being accessed without authorisation. As a result, organisations may face claims even where there is no evidence of financial harm. However, and as the UK Supreme Court confirmed in the case of Lloyd v Google [2021] UKSC 50 in 2021, compensation for breach of data protection legislation requires proof of material damage or distress and is not available for "loss of control" of personal data alone. By contrast, damages for misuse of private information may be awarded for the loss of control of private information itself, without proof of material damage or distress. In practice, claims are often brought under combined heads, such as data protection and misuse of private information, or data protection and breach of confidence, though different principles apply to each cause of action.

• claims for breach of confidence and misuse of private information require a positive wrongful action or disclosure by an organisation, rather than solely a security failure
• a claim for misuse of private information requires the harm or distress to cross a minimum threshold of seriousness (known as the de minimis principle). This can make it harder to pursue low-value claims where only basic contact details have been exposed.
• there is no de minimis threshold of seriousness required to claim compensation purely under statutory data protection laws, though the matter is currently under consideration by the UK Supreme Court in the appeal case of Farley & Ors v Paymaster (1836) Limited (trading as Equiniti) [2025] EWCA Civ 1117 (at the time of writing the decision is outstanding following a hearing in October 2026). As a result, and unless the law changes, even modest distress may found a claim, which increases the potential scale of group actions.

Where the breach affects a significant number of individuals, large-scale group litigation can arise. Law firms, together with litigation funders, have shown a willingness to pursue mass data breach claims where large volumes of personal data are involved. Recent examples of such group claims include:

• British Airways: More than 16,000 individuals commenced litigation after a 2018 cyber-attack affecting around 430,000 customers’ personal and payment card information. The claims settled confidentially in 2021, with no admission of liability, after the ICO fined BA £20 million (reduced from a proposed £183.39m).
• Marriott International: Up to 339 million hotel guest records including seven million UK guests were unlawfully accessed on a hotel reservation database between 2014 to 2018. The ICO fined Marriott £18.4m in October 2020 (reduced from a proposed £99.2 million). A representative claim, where one individual sues for everyone with the same interest, was commenced in England & Wales in August 2020, seeking compensation for the affected hotel guests in the jurisdiction. Following the decision in Lloyd v Google in 2021 that compensation requires proof of material damage or distress and is not available solely on loss of control, it was reported the action had been discontinued in June 2022.

• Capita: Personal data of over 6.6 million people was stolen in a cyber-attack in March 2023. In 2025 the ICO fined Capita £14 million (reduced from £45m) for failing to ensure the security of the data. Litigation on behalf of affected individuals is ongoing after the High Court rejected Capita’s attempt to strike out compensation claims in March 2026.

• Ticketmaster UK: Around 40,000 UK customers were understood to be affected in a cyber-attack on the Ticketmaster website in 2018 through a chatbot supplied by a third party compromised personal & payment data. In November 2020, the ICO fined Ticketmaster £1.25 million for failing to put appropriate security measures in place for the chatbot service, where one factor was that a significant number of individuals were affected, totaling 9.4 million customers, of which approximately 1.5 were based in the United Kingdom. Affected customers subsequently brought group litigation with reports in 2022 that the claims were concluded with a confidential settlement and on the basis of no admission of liability.

While none of these examples reached a full trial, litigation is time-consuming and costly and comes on top of any regulatory action. A claim for breach of data protection legislation is generally subject to a six-year limitation period, so litigation may arise long after the incident itself.

Top tips for compliance

• Limit access to personal data. Ensure employees only have access to the information they need to perform their role in order to protect security.
• Train staff regularly. Employees remain a prime target for phishing and social engineering attacks. Regular awareness training is therefore essential to reduce the risk of security breaches and to demonstrate compliance with data protection law.
• Test your response plan. An effective breach response plan should be put in place, reviewed and tested regularly, to ensure key personnel understand their roles and responsibilities.
• Act quickly when incidents occur. Early investigation, containment and assessment are crucial to mitigate the impact of a breach and to determine, within the 72-hour window, whether the ICO and affected individuals must be notified.
• Keep security measures under review. Cyber threats evolve constantly and security controls should be reviewed regularly to ensure they remain appropriate to the risks faced by the organisation.
• Manage third-party risk. As the ASOS incident shows, customer data is often held on third-party platforms. Organisations should carry out due diligence on vendors, ensure contracts include appropriate security and breach notification obligations, and control how employee access to those platforms is secured.
• Prepare your communications in advance. Draft template notifications for the ICO, affected individuals and the media so that clear and accurate messages can be issued quickly, reducing reputational damage and the risk of complaints and claims.

A&L Goodbody's Data Protection and Commercial & Technology teams regularly advise organisations on breach readiness, incident response, regulatory notifications and defending data protection claims.

For more information on any of the issues raised in this article, please contact Ciaran O’Shiel, Partner, Keith Dunn, Partner, Daniel Shaw, Associate, James Ruddy, Trainee Solicitor or a member of our Data Protection and Commercial & Technology teams.

Date published: 2 November 2026