Possibly. A cyber attack or hacking incident does not automatically mean the organisation is responsible.

The key question is usually whether the organisation took reasonable steps to protect the personal data it held. If there were security failings and those failings caused harm, a claim may be possible.

These claims can be complex because they may involve technical evidence about IT systems, security measures, third party software, access controls and how the breach occurred.

Havard Law Solicitors can review the information available and advise whether there may be grounds to investigate further.