In 2023, MOVEit, a platform promising secure file management, fell victim to a data breach. The breach sent shockwaves across the world as it affected thousands of organisations that relied on MOVEit for secure file transfer.  

Among the affected was Zellis, a company providing payroll support services to numerous businesses in the UK. The breach exposed sensitive personal data of Zellis’ clients, triggering concerns about privacy and security. Numerous other UK organisations were compromised in the MOVEit data breach. Given that some of these stored personal data sourced from others, the ripple effect of the MOVEit data breach continued to unfold. 

Following the data protection breach, several UK law firms announced that they were considering launching class action lawsuits to help victims get damages. But, with so many companies involved, who exactly is responsible for paying compensation to victims?

Who is responsible for the MOVEit data breach?  

The answer is complicated! While MOVEit was hacked, organisations are responsible for the security of their personal data. So any organisation that has had its employee/customer data hacked in this violation could be in trouble.  

When considering what action to take, the Information Commissioner’s Office (ICO) will look at the security measures of all the affected organisations and assess how they share data with third parties. The ICO is unlikely to fine any organisation that has robust data protection practices in place. But the ICO isn’t responsible for getting justice for victims of data breaches, and the relevant law firms will be considering their chances of success when deciding who to hold accountable for the loss of personal data. 

What is a class action claim?  

In the UK, if a group of people have experienced loss, or otherwise been harmed by an organisation’s law breaking, they can come together to fight for justice. Levelling the playing field when standing up to big businesses, these class action claims (otherwise known as group action claims) prove that there is strength in numbers.  

In the UK, group claims are becoming common across various industries, addressing different types of alleged wrongdoing – including data breaches. For example:  

• In 2021, the British Airways data breach action was resolved on confidential terms following successful mediation and negotiation 
• In 2022, Ticketmaster settled a data breach group action on a no-admission basis 
• Law firms are currently pursuing a group action claim against Capita after UK pension holders and their beneficiaries had their data breached 

Make a MOVEit data breach compensation claim 

If you are affected by the MOVEit data breach you could have a no-win, no-fee data breach compensation claim. Our simple eligibility checker provides instant clarity. Answer a few straightforward questions, and you’ll know if you could qualify to join a group action claim.