The Greencore data breach was first detected in December 2021, but employees were not informed until February 2022. This two-month delay sparked concern over how businesses handle cyberattacks and the potential risks that arise when affected individuals are left in the dark.

Why did it take two months to inform Greencore employees?

After a data breach, companies are legally required to act quickly. Under UK data protection laws, organisations must:

• Assess the severity of the breach as soon as it is discovered.
• Notify affected individuals without undue delay if their data is at risk.
• Report the incident to the ICO within 72 hours of detection if it poses a serious risk.

Greencore took two months to inform employees, which has raised questions about transparency and employee protection.

What does this delay mean for affected employees?

During the two-month gap, employees were:

• Unaware their personal data had been exposed.
• Unable to take preventative action, such as monitoring their financial accounts.
• Potentially at risk of fraud or scams without knowing it.

Cybercriminals often act quickly once they obtain stolen data. This delay may have given hackers a head start, increasing the risk of:

• Bank fraud – If account details were exposed.
• Identity theft – Using passport or National Insurance details.
• Phishing scams – Targeted emails or phone calls using personal information.

Even though Greencore later claimed there was no evidence of data misuse, the delay put employees at unnecessary risk.

The emotional impact of delayed notification

Beyond the practical risks of fraud and identity theft, the psychological toll of a delayed notification can be significant. Once they were made aware of the hack, employees who were affected by the Greencore data breach may have suffered heightened anxiety and distress for several key reasons:

• Increased uncertainty and anxiety: Employees had two months of potential exposure without being aware of the breach. After being notified, many were left wondering whether their data had already been misused. For some, this resulted might have caused difficulty sleeping, increased stress, or even paranoia about online safety.
• Loss of control: Not knowing their personal data had been stolen means employees had no opportunity to take protective measures. Once they were informed, many likely felt powerless as well as exposed.
• Erosion of trust: A two-month delay in notification raises questions about transparency and whether the company prioritised its own reputation over employee safety. This can create mistrust between employees and their employer.

For many employees, financial harm is not the only consequence of a data breach. The emotional distress caused by uncertainty and vulnerability can be just as damaging.

Are you eligible for compensation?

If you were affected by the Greencore data breach, you may be entitled to compensation for the increased risks and emotional distress caused by the delayed notification.

At Join the Claim, we help employees hold businesses accountable for data protection failures.

Check your eligibility today and take action.