What to do after a retailer data breach

This guide will show you what to do straight away, how to lock down your accounts, how to spot the scams that often follow a breach, what to do if money’s already been taken, and where to report problems.

A data breach is when a company’s systems are accessed by someone who shouldn’t have got in and information gets exposed, lost or stolen as a result. Retailers are a common target for criminals because they hold so much personal and financial information about their customers in one place.

Depending on the breach, the information exposed might include your email address, your password (usually "hashed", or scrambled, rather than in plain text), your phone number, your home address, your order history, or your date of birth.

You might see retailers say "no payment details were affected" but it doesn’t mean you’re safe. Even without your card details, criminals can do a lot with the rest of your information. That's because criminals can use leaked data to:

• send convincing phishing messages 

• try to take over your account

• commit identity fraud in your name, or 

• run delivery scams that trick you into handing over more information or money.

Our section on Scams has detailed guidance on what to look out for and what to do if you’re caught out. 

If you’ve just found out about a data breach, a few quick actions can make a big difference. 

1. Do not click any links in emails or texts about the data breach, even if they look like they’re from the retailer. Instead, go directly to the retailer’s website or app by typing the address yourself or opening the official app.

2. Once you’re logged in safely, check your account for anything unusual, such as orders you didn’t place, a delivery address you didn’t change, a different email or phone number on file, or payment methods you don’t recognise.

3. Then change your password for that retailer straight away. If you’ve used the same password anywhere else, change it there too.

Find out how to protect yourself from scams and fraud in our guide Shopping and paying safely online.

Once you’ve dealt with the immediate risk, take a little more time to secure your accounts properly.

1. Use a strong, unique password for each account rather than reusing the same one. A password manager can remember them for you.

2. If the retailer offers two-factor authentication, turn it on. It adds an extra step, like a code sent to your phone, making it much harder for anyone else to get in.

3. Where you can, log out of other devices and review any apps or devices connected to your account.

4. Remove any saved payment methods or addresses you don’t need, especially if you don’t often shop with that retailer.

After a data breach becomes public, scammers often move quickly to take advantage, so it helps to know what to look out for.

Phishing emails are one of the most common tricks, often pretending to be the retailer and asking you to "reset your password", warning that your "account is locked", or claiming to run a "security check".

You might also see fake refund or compensation messages. These often ask for your bank details, mention a "small fee to process your refund", or include a link to "claim" money that doesn't actually exist.

Delivery and redelivery scams are common too, with texts about a "missed parcel" asking you to pay a small charge or confirm your delivery address. 

And watch out for impersonation more generally, including fake customer support phone numbers, messages through social media, and websites designed to look like the real thing.

Want more detail on spotting these kinds of messages? Our guide Types of scams covers the different ways you could be scammed, so you can recognise them with confidence, and help friends and family do the same.

Sometimes a data breach leads to your account being taken over by someone else. Signs of this include: 

• your password no longer working 

• login alerts for sign-ins you didn’t make 

• orders appearing that you didn't place, or  

• your contact details being changed without your knowledge. 

If this happens, reset your password straight away using the official "forgotten password" route on the retailer’s website or app, rather than any link sent to you. Secure your email account too.  

Then contact the retailer’s support team using contact details from their official website, not from any message you’ve received, and keep a record of everything, including dates, times and what was said. 

To help prevent this happening again, stick to unique passwords for each account, turn on two-factor authentication wherever it's offered, and keep your email account properly secured. 

It’s worth taking a close look at your recent transactions and your order history with the retailer, including anything showing as "pending".

If you spot a card payment you don’t recognise, contact your bank straight away and follow their fraud reporting process. They’ll be able to help you dispute the payment and protect your account going forward. 

Keep hold of any evidence that might help your case, such as:

• screenshots 

• order confirmations

• reference numbers 

• dates and times, and 

• any chat transcripts with the retailer or your bank. 

Find out more in our guide How to sort a problem with a payment.

If you’ve lost money because of fraud linked to a data breach, there are a couple of ways that might help you get it back.

• Chargeback is a process your bank can use to reverse a payment in certain situations, for example if you’ve been charged for goods you didn't buy, or goods you ordered never arrived because of fraud.

• Section 75 is a legal protection that may apply if you paid by credit card and the purchase meets certain criteria, giving you added protection beyond chargeback.

To raise a claim, contact your bank and be ready to explain what happened, when, and provide any supporting evidence you've gathered. 

Find out more in our guide How section 75 and chargeback protection work for your credit and debit cards.

A data breach can sometimes lead to identity fraud, where someone uses your personal details to apply for credit or services in your name. Warning signs include:

• credit applications you didn’t make

• letters about accounts you don't recognise, or 

• debt collectors chasing you for debts that aren’t yours. 

To reduce the risk, check your credit file regularly and keep an eye on your post and email for anything unexpected.

If suspect your identity has been stolen, act quickly. Contact the relevant organisations, such as your bank and the credit reference agencies, and keep a careful record of everything you find and everyone you speak to. 

Find out more in our guide Identity theft and scams: how to get your money back.

If you've received a phishing attempt or suspicious message, report it. Do not reply or click any links, and do not share any details. 

Already given away passwords, bank details or card details? Call your bank straight away, change any passwords you've shared, and report what's happened. 

If you need to report a scam or get advice, contact: 

• Action Fraud: the UK’s national reporting centre for fraudOpens in a new window and cybercrime. 

• Information Commissioner's Office (ICO): for questions about your data rights, or to report a data breachOpens in a new window

• National Cyber Security Centre (NCSC): for advice and support on staying safe onlineOpens in a new window