The short answer
If your broadband provider has told you your personal data was caught up in a breach, don't panic, but don't ignore it either. Being told doesn't automatically mean you're at risk: the Information Commissioner's Office (ICO), the UK's data protection regulator, says organisations sometimes tell people simply to be open. Still, a few checks are worth the time, because criminals use breached details, and news of a breach, to make scams more convincing.
Details were checked between 9 and 14 October 2026. From 30 September 2026 the law refers to the "Information Commission" (a change under the Data (Use and Access) Act 2025), but the regulator's pages still said "ICO" on 14 October 2026, so we use ICO here.
What to do in the first day or two
Most of these steps come from the ICO and the National Cyber Security Centre (NCSC), the UK government's cyber security advice service.
1. Check the notice is genuine
Confirm the breach through your provider's official website, app or social media accounts, typing the address yourself, not using links or contact details in the message, as the NCSC advises. A genuine statement should confirm whether a breach happened, how you're affected and what you should do. After a big breach, the NCSC warns, phone lines may be overwhelmed, so the website or app is often the quicker route.
Criminals sometimes pose as the breached company, and the NCSC says they exploit high-profile breaches even against people whose details weren't taken.
2. Secure your passwords
The NCSC's advice is that if a message quotes a password you still use, you should change it, along with any other account that uses the same password. We'd go a step further: if the provider says passwords or login details were involved, or it isn't yet clear, change:
- the password for your broadband online account or app;
- the password for any email address your provider gave you;
- any other account using the same password.
The NCSC also suggests considering a passkey (signing in with your phone or computer instead of a password) where offered. The ICO recommends strong passwords and multifactor authentication, such as 2-step verification (a code from your phone or an app as well as your password). Then look for the signs the NCSC lists: being locked out, security settings you didn't change, messages you didn't send, logins from odd places. The NCSC mentions haveibeenpwned.com for checking whether your email address has appeared in public breaches.
If you think your provider email account has already been taken over, our guide to what to do when a provider email account is hacked walks through recovery.
3. Get ready for follow-up scams
The NCSC says breached information is used to make phishing (fake messages designed to steal details or money) look legitimate, and that it can arrive some time after the breach. Its list of themes to be wary of reads like a breach scammer's script:
- "resetting your password";
- "receiving compensation" for the breach;
- "scanning your devices";
- "missed deliveries".
Scam calls may ask for bank details, passwords or remote access to your computer. A caller who knows your name, address and account number proves nothing: those may be exactly the details that leaked. Hang up and ring your provider on a number you've found yourself.
Our guide to spotting and reporting broadband scam calls and emails explains how to check a contact, and if someone says one of your devices is infected, read what to do when your provider says a device is infected before you act.
4. Check your bank account and credit file
The ICO suggests checking your bank statements and getting a copy of your credit report, and contacting your bank if anything looks unusual. If someone calls claiming to be your bank, the ICO's advice is to hang up and call the number on the back of your card, use your bank's app or website, or, if your bank supports it, call 159 to be put through to your bank safely.
What counts as a data breach (and what doesn't)
The ICO describes a personal data breach as a security failure that leaves your information lost, destroyed, altered or damaged, or accessed, disclosed or kept by someone who shouldn't have it, whether by accident, deliberately, recklessly or in a cyber-attack. The ICO's examples include lost or stolen paperwork or devices, the wrong person receiving your information, and someone viewing it without authorisation.
Not everything that feels like a breach is one: sharing your data without consent can be lawful, as when, in the ICO's example, a mobile phone company passes an overdue customer's details to a debt collector. For questions about how your provider uses your data generally, see our guide to your data rights with your broadband provider.
What your broadband provider must tell you
Two sets of rules apply. Most organisations only have the general UK GDPR duty. Broadband and phone companies also have a specific duty under the Privacy and Electronic Communications Regulations 2003 (PECR), because they provide what the law calls a "public electronic communications service".
The telecoms rule: PECR regulation 5A
Under regulation 5A, if a breach is likely to adversely affect your personal data or privacy, your provider must tell you without undue delay. Note the wording: the general UK GDPR rule below only applies where a breach is likely to result in a "high risk". The notice must at least describe the nature of the breach, give contact points for more information and recommend measures you can take to reduce harm. It isn't needed if the provider satisfies the regulator that the data was unintelligible to outsiders, for example encrypted, and the regulator can order a provider to tell its customers.
Regulation 5 also requires providers to keep personal data secure: at a minimum, only authorised staff should reach it, and it must be protected against loss, alteration and unauthorised access or disclosure. If a significant security risk remains, the provider must tell subscribers about it, what they can do and the likely costs.
The general rule: UK GDPR Article 34
Under Article 34, a breach likely to result in a high risk to your rights and freedoms must be reported to you without undue delay, in clear and plain language. In the ICO's words, an organisation doesn't always have to tell you, but if a breach is likely to put you at risk, for example your wellbeing, finances or ability to work, it must tell you directly and as soon as reasonably possible. It's for the organisation to judge. The table compares the two rules.
PECR regulation 5A (broadband and phone providers) | UK GDPR Article 34 (all organisations) | |
|---|---|---|
When you must be told | Breach likely to adversely affect your personal data or privacy | Breach likely to result in a high risk to your rights and freedoms |
How quickly | Without undue delay | Without undue delay |
What the notice must cover, at least | Nature of the breach; contact points for more information; measures you can take to reduce harm | Nature of the breach in clear, plain language; a contact point; likely consequences; measures taken or proposed |
Main exceptions | Provider shows the regulator the data was unintelligible, e.g. encrypted | Data protected, e.g. encrypted; high risk removed; disproportionate effort (public notice instead) |
Reporting to the regulator
Under PECR, a provider must report a breach to the regulator without undue delay and, where feasible, within 72 hours (wording added from 20 August 2025 by the Data (Use and Access) Act 2025), and keep an inventory of breaches. Under UK GDPR (Article 33), information can be sent to the regulator in stages. So a first message may be brief while the provider investigates: ask for updates.
Questions to ask your provider
Use the contact point in the notice (checked against the provider's official website) and ask, in writing where you can:
- Was my data actually involved, or is this a general notice to all customers?
- Which details exactly: name, address, phone number, email, date of birth, account number, bank or card details, passwords, security questions?
- When did the breach happen, and when did you discover it?
- Was the data encrypted?
- What have you done to stop it happening again?
- What do you recommend I do?
- Are you offering any support, such as credit monitoring?
- How will you contact me about this, and how can I tell those messages are genuine?
Some providers offer support: after its November 2025 breach (below), Brsk said it was offering affected customers 12 months of free Experian monitoring. Nothing in the rules we checked requires this, so treat it as goodwill rather than something you're owed.
Keep every reply, with dates.
Protecting yourself from fraud in the months after
If only contact details were taken, the main risk is more convincing scams (Brsk, for instance, asked customers to be vigilant for unexpected emails or calls). If financial or identity details were involved, identity fraud is the bigger concern.
Keep an eye on your credit file
The three main UK credit reference agencies are Equifax, Experian and TransUnion. The ICO says asking an agency for a copy of your credit file is free. The agency normally has one month to respond; in some cases it can take up to two months longer, but it should tell you within the first month if it needs more time, and why.
The ICO lists these warning signs of identity theft:
- bills for goods or services you didn't order;
- letters from debt collectors about debts that aren't yours;
- being refused credit when you didn't expect it;
- a falling credit rating even though you haven't missed payments.
If a broadband or phone contract turns up that you never took out, follow our guide to what to do when broadband is taken out in your name.
The ICO also suggests considering Cifas Protective Registration as an extra layer of protection. A fee applies, so check the current cost and how it works on Cifas's own website before you sign up.
Where to report scams and fraud
What happened | What to do |
|---|---|
Suspicious email | Forward it to report@phishing.gov.uk |
Scam text message | Forward it free to 7726 |
Suspicious phone call | Hang up and contact your phone provider |
You've lost money (England, Wales or Northern Ireland) | Tell your bank, then report to Report Fraud at reportfraud.police.uk or on 0300 123 2040 |
You've lost money (Scotland) | Tell your bank, then call Police Scotland on 101 |
You're worried for your safety | Contact the police |
The NCSC now directs people who have lost money to Report Fraud (reportfraud.police.uk), so use that rather than any older reporting name you may see in a notice or help page.
How to complain to your provider
Ask the provider what happened, what information was affected and what it plans to do. The ICO's tips:
- Use the provider's own data protection complaints process (check its privacy policy), not social media, and say clearly it's a data protection complaint.
- Include account and reference numbers, dates, a short list of concerns and how the breach has affected you, in around 500 words. The ICO publishes a complaint letter template.
- Keep records, and follow phone calls up in writing.
The provider has 30 days to acknowledge your complaint, counted from the day after it receives it (the next working day if day 30 is a weekend or holiday). That isn't a deadline to resolve it. Data protection law sets no fixed time for the outcome, which must come without unjustified delay. The outcome should confirm whether your data was involved, acknowledge the effect on you and advise on next steps.
Example complaint you can adapt
A template, not a real case:
"This is a data protection complaint. My account number is [number]. On [date] you told me my personal data was affected by a breach. Please tell me which of my details were involved, when it happened, what you have done to prevent a repeat and what I should do. Since the breach I have [describe the effect, for example calls quoting my account number, or money taken from my account]. I would like [an explanation / an apology / compensation for the losses listed]. Please acknowledge this complaint."
This data protection route is separate from the usual process for broadband service complaints such as billing or faults, which our guide on how to complain about your broadband provider covers.
Taking it to the ICO
If you're unhappy with the provider's response, you can complain to the ICO. It recommends letting the provider finish its own process first. You'll need the provider's email address, a copy of your complaint to it and any supporting information about the harm the breach caused you.
The ICO now prioritises cases with clear, serious harm. When we checked on 14 October 2026, its complaints page said complaints needing detailed investigation were being assigned to a case officer around 10 months after submission. The most common outcomes are that the ICO logs the complaint, or tells the organisation to do more work or explain its position. The ICO helpline is 0303 123 1113, and there's live chat on its website.
Its complaint guidance (29 June 2026) was still marked under review on 14 October 2026, so details may change.
Can I claim compensation?
Possibly, but not through the ICO, which can't award compensation or advise on claims.
Under UK GDPR Article 82, anyone who suffers material damage (such as lost money) or non-material damage (such as distress) because data protection law was broken can claim compensation from the organisation responsible. The organisation escapes liability only if it proves it was not in any way responsible for the event that caused the damage.
The route the ICO describes:
- Ask the provider directly, in writing, with your evidence. It may agree to pay without a court claim.
- If it won't pay, the next step is a court claim. The ICO strongly recommends taking independent legal advice about the strength of your case before going to court. A solicitor can also explain the likely costs and whether any time limits apply to you.
- You don't have to wait for the ICO. You don't need to complain to the ICO, or wait for its outcome, before going to court.
We found no official source for typical payouts, so we give none. Article 82 is about damage you suffered, so keep a record of what happened to you:
- the breach notice and every reply from the provider;
- a dated log of scam calls, texts and emails that seem linked, with screenshots;
- bank statements showing any losses, and what your bank told you;
- notes of how it has affected you.
Past data breaches at UK broadband providers
Dated examples, as reported at the time:
- TalkTalk, October 2015. A cyber-attack involving 156,959 customers' details, as reported by ISPreview. The ICO fined TalkTalk £400,000 in 2016 over the security failings behind it. In 2019 TalkTalk said 4,545 customers may have received the wrong notification about that incident.
- TalkTalk, fined August 2017. On 10 August 2017 the ICO fined TalkTalk £100,000 after accounts at its outsourced call centre were used to access the personal data of 21,000 customers.
- Brsk, November 2025. The altnet said it was investigating unauthorised access to a customer database, and ISPreview reported on 27 November 2025 that a dataset of 230,105 records was being advertised for sale. Brsk said only basic contact information was involved, with no financial details, passwords or logins, and that it had told affected customers, the ICO and the police. We found no ICO outcome for this case.
Our TalkTalk broadband page and BT broadband page have more on each provider.
Should you switch provider after a breach?
A breach on its own may not let you leave for free. We found no rule letting you end a contract early without charges just because of a breach. Our guide to leaving broadband early and when exit fees apply covers the situations where you can, and what to do when your broadband contract is ending explains your options once the minimum term is up.
Switching itself is straightforward. Under One Touch Switch, Ofcom's switching process, you contact only the new provider. Your current provider must then send you the switching information, including any early termination charges, so you'll see what leaving would cost before you agree.
If you use a provider email address, read our guide to keeping your email address when you switch first. When you're ready, you can compare broadband deals at your postcode through our comparison partner, or read about each provider on our broadband providers hub. We don't switch you ourselves or rate providers' security.
Broadband data breach FAQs
Does my broadband provider have to tell me about a data breach?
Yes, if the breach is likely to adversely affect your personal data or privacy. Broadband and phone providers have a telecoms-specific duty under PECR regulation 5A to tell you without undue delay in that case. That test is worded differently from the general UK GDPR rule, which only applies to a breach likely to result in a "high risk" to you. The exception is data the provider shows the regulator was unreadable to outsiders, for example encrypted.
What should a breach notice from my provider include?
Under PECR regulation 5A, the notice must at least describe the nature of the breach, give contact points at the provider for more information, and recommend steps you can take to reduce any harm. If it doesn't say which of your details were involved, ask in writing.
Is an email about my provider's data breach a scam?
It might be. The NCSC says criminals pose as breached organisations and use high-profile breaches to send convincing phishing, including messages about resetting passwords or receiving compensation. Check on your provider's official website or app instead of using the message's links, and forward suspicious emails to report@phishing.gov.uk.
Should I change my passwords after a provider data breach?
It's sensible, especially if the provider says passwords or logins were involved. Change your broadband account password, any provider email password and any other account using the same password, then turn on 2-step verification.
Will the ICO get me compensation for a data breach?
No. The ICO can't award compensation, even when it finds the law was broken. Under UK GDPR Article 82 you can claim for material or non-material damage, such as lost money or distress. Ask the provider directly first; if it won't pay, the next step is a court claim, and the ICO strongly recommends independent legal advice.
How long does an ICO complaint take?
There's no fixed timescale. On 14 October 2026 the ICO said complaints needing detailed investigation were being assigned to a case officer around 10 months after submission. It prioritises cases with clear, serious harm and recommends complaining to the provider first.
Can I leave my broadband contract because of a data breach?
We found no rule that lets you leave early without charges because of a data breach alone, so don't assume it. If you switch under One Touch Switch, your current provider must send you the switching information, including any early termination charges, before you confirm, so you'll know the cost first.
