My data's been stolen in a cyberattack - can I sue?

What legal responsibilities does a company have to keep your data secure? M&S, and the Co-op are picking up the pieces after their systems were hacked. The cyber criminals claim to have the private information of 20 million people who signed up to Co-op's membership scheme, but the firm have not confirmed that number. The Co-op says the breach did not include members’ passwords, bank or credit card details. However, experts say seemingly innocent information can be used to commit fraud or identity theft. Companies aren’t the only target; on Monday this week, the Ministry of Justice revealed that the Legal Aid Agency was also hacked in April. So can you sue if your private data is stolen in this way? And if you're the employee who clicked on a hacker's dodgy link in an email, how liable are you for any losses that occur? Also on the programme: How survivors of domestic violence in Scotland want to be told if their attackers make plea deals. Presenter: Joelle Grogan Producers: Ravi Naik and Charlotte Rowles Editor: Tara McDermott Contributors Joe Tidy, BBC Cyber Correspondent Tim Capel, Legal Counsel for the Information Commissioner’s Office Ian Jeffrey, Chief Executive of the Law Society Brian McConnachie KC, a former crown prosecutor and now a senior advocate:

You can listen to My data's been stolen in a cyberattack - can I sue? online on Radio and Podcast. Open the player on this page to stream the available audio.

My data's been stolen in a cyberattack - can I sue? is an episode from Law in Action by BBC.

This episode is 28:29 long.

This episode was published on May 21, 2025.

Yes. Use the heart button on the episode page to add it to your favorite episodes list.

Yes. This page shows related episodes from Law in Action when more episodes are available from the podcast feed.