If you worked at Boots and received news that your personal details were exposed in a data breach, you’re not alone. And you could be entitled to compensation.
In June 2023, a global cyberattack made headlines after hackers exploited a vulnerability in a popular file transfer tool called MOVEit. Among the organisations affected was payroll provider Zellis – a company used by major UK employers, including Boots.
The result? Sensitive information belonging to current and former Boots employees was potentially exposed. Understandably, many people were left shocked, worried, and wondering what their options were.
Here’s what you need to know.
What happened in the Boots data breach?
MOVEit is a file transfer tool used by businesses around the world to securely move sensitive data. But in May 2023, hackers found a way in – and they exploited it on a huge scale.
Zellis, which handles payroll services for Boots, was among those affected. In the weeks that followed, Boots began informing employees that their data may have been compromised.
Investigators have since linked the cyberattack to a Russian criminal group known as ‘Clop’. This group has claimed responsibility for similar breaches at other global companies.
What personal data was exposed?
The data breach impacted the PAYE details of Boots employees. This includes:
- Names and titles
- Employee numbers
- Dates of birth
- Email addresses
- Partial home addresses
- National Insurance numbers
- Employment start and end dates
This kind of information could be enough for criminals to commit identity theft, commit fraud, or simply cause distress. Even if your finances weren’t affected directly, the emotional toll of knowing your data is out there can be significant.
Can I claim compensation if I worked at Boots?
If you were employed by Boots on or before June 2023 and your data was compromised in the Zellis breach, you may be eligible to join a group legal action.
You don’t have to prove financial loss to make a claim. UK data protection laws allow for compensation based on the emotional impact of a breach – such as anxiety, stress or inconvenience. In many previous group actions, claimants have received hundreds or even thousands of pounds in damages.
Data breaches like this can leave people feeling powerless – especially when they involve trusted employers. But UK law is on your side. If you’ve been affected, you have every right to explore your options and seek justice.
Join the Claim connects consumers with SRA-regulated lawyers. Visit the claim page to check your eligibility if a claim is open with one of our trusted legal partners. If a group action has not yet been launched, you can register your interest and we’ll keep you informed if a partner firm decides to take a claim forward.
