What to do if a company tells you it’s been hacked, and how to protect yourself

Being told that a company you use has been hacked and your data may have been compromised can be worrying. You may immediately wonder whether your information has been stolen, if your money is safe, and what you should do.

If you shop with Asos, you may have received a message this week claiming that hackers had “fully compromised” the retailer’s data.

But the message was unauthorised. Asos later apologised to customers, telling them to disregard the notification and not to click on or engage with the link it contained.

The online fashion retailer said some basic personal information, including customers’ names and contact details, might have been accessed by an unidentified third party.

But, it said it did not believe payment card records or passwords had been compromised.

The incident comes after a string of cyber incidents involving major British retailers, including Harrods, Marks & Spencer and the Co-op last year. M&S and the Co-op experienced stock shortages, while M&S was forced to close its website for several weeks as it worked to make sure its systems were secure.

For customers, incidents like these can be unsettling. Even when a company says your financial information or password has not been affected, you may still be left wondering whether you need to take action.

There are several simple things you can do to reduce your risk.

Don’t panic, but don’t ignore it

If a company you use tells you it has suffered a cyber incident, read its advice carefully. Check the company’s official website or app for information rather than automatically trusting an email or text message you have received.

This is particularly important because criminals can use real cyberattacks as an opportunity to launch convincing scams. You might receive a message pretending to be from the company, offering a refund, asking you to reset your password or telling you that your account needs to be verified.

Don’t click the link

If you need to check your account or find out what has happened, go directly to the company’s website by typing its address into your browser or using its official app.

Change your password if necessary

If there is any possibility that your password has been exposed, change it as soon as possible.

Use a strong, unique password that you don't use anywhere else. A long passphrase made up of several unrelated words can be easier to remember while still being difficult for criminals to guess.

And if you have used the same password on other websites, change it there too.

A data breach at one company can become a much bigger problem if criminals obtain a password that also works for your email, banking, shopping or social media accounts.

Turn on two-step verification

If an account offers two-step verification, or two-factor authentication, turn it on – particularly for important accounts such as your email, banking and shopping accounts.

It means that even if someone manages to obtain your password, they may still need a second form of verification before they can get into your account.

You can usually switch it on through the security settings of the app or website.

Keep an eye on your money

Even if a company says payment details have not been compromised, it’s sensible to keep an eye on your bank and card accounts.

Look out for transactions you don't recognise and contact your bank immediately if you spot anything suspicious.

Watch out for follow-up scams

A cyberattack can give scammers an opportunity to contact you afterwards, pretending to be the company that was hacked.

You could receive an email, text message or phone call claiming that your account has been compromised. You might then be told that you need to click a link, confirm your identity, provide a code, change your password or make a payment to protect your account.

Be wary of unexpected requests

If someone phones you claiming to represent the company, you don't have to stay on the line. Hang up and contact the organisation yourself using a phone number, website or app that you know is genuine.

Be especially careful with verification codes

If you receive a security code that you didn't request, don't give it to anyone who contacts you.

A scammer may already have your password and be attempting to log into your account. They may then phone you pretending to be from the company and ask you to read out the code they have just sent you.

That code could be the final thing they need to access your account.

Check your email account too

Your email account is particularly important because it can often be used to reset passwords for your other accounts.

Make sure it has a strong, unique password and two-step verification enabled. Check the account's security settings occasionally and look for unfamiliar devices or login activity.

If criminals gain access to your email, they could potentially use it to take over other accounts.

Think before you click

Even if the message looks convincing and uses the company's logo and branding, it could be fake.

What should you do if your information really has been stolen?

If a company confirms that your personal information has been accessed, follow the advice it gives you and take any recommended steps promptly.

If you think your account has been taken over, contact the company through its official channels. If you think you've been the victim of fraud or have lost money, contact your bank immediately.

A company being hacked isn't necessarily something you can prevent. But you can make sure you're are a much harder target for the criminals who may try to take advantage of it afterwards.