3c:I[58016,["/_next/static/chunks/0jjo8hz~ewue4.js","/_next/static/chunks/0abq8zp15pmva.js","/_next/static/chunks/05gz47kazl1ze.js","/_next/static/chunks/139o5utivfajl.js","/_next/static/chunks/0a~e7k..h6jfc.js","/_next/static/chunks/0d1e9m2ig9v3v.js","/_next/static/chunks/0fg30bidui1gn.js","/_next/static/chunks/0rizq9ux3s1w3.js","/_next/static/chunks/0bbc2ioe2xmkf.js","/_next/static/chunks/0z7avafhgjcyr.js"],"ProcessEpisodeButton"] 3e:I[185,["/_next/static/chunks/0jjo8hz~ewue4.js","/_next/static/chunks/0abq8zp15pmva.js","/_next/static/chunks/05gz47kazl1ze.js","/_next/static/chunks/139o5utivfajl.js","/_next/static/chunks/0a~e7k..h6jfc.js","/_next/static/chunks/0d1e9m2ig9v3v.js","/_next/static/chunks/0fg30bidui1gn.js","/_next/static/chunks/0rizq9ux3s1w3.js","/_next/static/chunks/0bbc2ioe2xmkf.js","/_next/static/chunks/0z7avafhgjcyr.js"],"SendEmailButton"] 3f:I[45269,["/_next/static/chunks/0jjo8hz~ewue4.js","/_next/static/chunks/0abq8zp15pmva.js","/_next/static/chunks/05gz47kazl1ze.js","/_next/static/chunks/139o5utivfajl.js","/_next/static/chunks/0a~e7k..h6jfc.js","/_next/static/chunks/0d1e9m2ig9v3v.js","/_next/static/chunks/0fg30bidui1gn.js","/_next/static/chunks/0rizq9ux3s1w3.js","/_next/static/chunks/0bbc2ioe2xmkf.js","/_next/static/chunks/0z7avafhgjcyr.js"],"SignupCTA"] 35:["$","time",null,{"dateTime":"2025-05-21T14:30:00.000Z","children":"Wed May 21 2025"}] 36:["$","p",null,{"className":"text-base text-foreground/80 leading-relaxed","children":"UK retailers have faced cyberattacks - but what if your data is part of a breach?"}] 3d:T549,

What legal responsibilities does a company have to keep your data secure?

M&S, and the Co-op are picking up the pieces after their systems were hacked.

The cyber criminals claim to have the private information of 20 million people who signed up to Co-op's membership scheme, but the firm have not confirmed that number. The Co-op says the breach did not include members’ passwords, bank or credit card details. However, experts say seemingly innocent information can be used to commit fraud or identity theft.

Companies aren’t the only target; on Monday this week, the Ministry of Justice revealed that the Legal Aid Agency was also hacked in April.

So can you sue if your private data is stolen in this way? And if you're the employee who clicked on a hacker's dodgy link in an email, how liable are you for any losses that occur?

Also on the programme: How survivors of domestic violence in Scotland want to be told if their attackers make plea deals.

Presenter: Joelle Grogan Producers: Ravi Naik and Charlotte Rowles Editor: Tara McDermott

Contributors Joe Tidy, BBC Cyber Correspondent Tim Capel, Legal Counsel for the Information Commissioner’s Office Ian Jeffrey, Chief Executive of the Law Society Brian McConnachie KC, a former crown prosecutor and now a senior advocate:

My data's been stolen in a cyberattack - can I sue?