When customers take the stand: Cybersecurity faces a new kind of trial

Researchers estimate the cyber incident at Jaguar Land Rover could cost around £1.9 billion, making it the costliest cyberattack ever recorded in the UK. However, these costs may seem insignificant compared to those of future breaches.

Across UK radio stations and social media ads, consumers are being invited to "join the claim" against M&S, Co-Op, JLR, and many other organizations that have suffered high-profile data breaches. These are not regulatory notices or shareholder updates. They are consumer calls to action, designed to turn data breaches into collective legal movements.

We have all seen the annoying ads, emails, and text messages promising a big payout if we've been in a car accident, had a personal injury, or taken out a car loan in the last five years. But law firms are now turning their attention to the consumers impacted by high-profile data breaches.

The old mantra that "where there's blame, there's a claim" is returning once again. Customer-led group actions introduce a distinct form of risk, shaped by emotions and media attention.

What has changed in the cyber risk model

Businesses impacted could now find themselves in an impossible situation. Failing to report a data breach risks GDPR fines of up to €20 million or 4% of their total worldwide annual turnover. But when they admit to a data breach, it could increase legal exposure rather than reduce it.

Claims management companies and law firms can easily assemble tens of thousands of claimants within days using eligibility checkers, targeted advertising, and a no-win, no-fee promise.

The seamless online journey begins with a few questions and consent to data sharing, and then places you in pre-vetted group actions run by partner law firms. For the consumer, the process feels more like signing up for an online service than initiating litigation.

Joining a claim could quickly become the default response to a breach notification, rather than a considered legal decision. For organizations, this adds pressure, as breaches become marketing moments for litigation firms, driven by public sentiment rather than evidentiary thresholds.

Courts could soon be challenged with assessing compensation for loss of control over personal data, not just fines. With more than 10,000 claimants rushing to sign up for their share of a payout, a breach could get very expensive.

During the M&S and Co-op breaches, it's also worth noting that early statements suggested there was no evidence of customer data compromise. Those statements were later revised as investigations progressed and data access was confirmed.

In legal pleadings, this becomes evidence of undue delay and missed opportunities for customers to protect themselves. Under UK data protection law, timely and accurate notification is a duty, not a courtesy. This will change how public statements are drafted.

There is no escaping the fact that overassurance early on can later be recast as misleading, especially when forensic findings are uncovered.

How CISOs shape legal exposure during a breach

During a breach, the first thing an organization and its CISO must accept is that early technical uncertainty is standard, but pretending certainty where none exists creates long-term legal exposure.

Early responses like "there's no evidence at this point" require the same level of context: an explanation of what is already known, what is currently under investigation, and when further updates will be provided, as would any other response.

All parties involved (courts, regulators, claimant lawyers) will assess whether the initial messaging reflected the organization's internal confidence level at the time of issuance and, therefore, whether it was accurate.

Speed is essential. However, it cannot be at the cost of credibility. Early messaging that contradicts itself after the fact can be more damaging than a delayed message with a clear explanation of the delay.

Incident Response Plans developed by CISOs must include a Litigation-Aware Communications Track that involves legal, security, and customer teams agreeing on the language used for public messaging, the timing of messaging, and escalation procedures before issuing a public statement.

Each delay should be documented, each update dated/timestamped, and each decision traceable to who made it and when, as these documents will likely resurface months later in either the defense or the prosecution of allegations of negligence in handling customer duties of care.

Reputation, emotion, and momentum as risk multipliers

Once a group claim launches, its strength will be determined by public sentiment. A few rage-bait articles later, headlines about millions of affected customers, arrests linked to ransomware groups, or prolonged service disruption all create a sense of collective harm that will support any future claim of distress.

Retail breaches are particularly vulnerable because they involve visible disruption to our everyday lives. Unlike breaches in financial services or enterprise software, retail incidents can manifest as long queues in stores due to offline systems, apps that fail or go offline, and contradictory emails.

All of which contribute to a perception that an incident has been mishandled. That kind of visibility will inevitably amplify emotional responses and drive momentum behind group actions as consumers fight back.

The rise of online ambulance chasing

Claims management firms can drive interest in their cases through tried-and-tested marketing campaigns. Search, social media, and radio ads can easily capture angry or disillusioned customers seeking to get their hands on cash with minimal friction.

Some critics describe this as digital ambulance chasing. The accusation is that these firms monetize anxiety and uncertainty, turning vague fears about data breaches into lucrative revenue streams.

However, regulators such as the UK Information Commissioner's Office rarely issue fines without clear evidence of negligence. For many consumers, group actions are the only available route to compensation for the loss of control over personal data.

A new kind of trial

Cyber breaches are no longer contained within incident room walls – they become part of public discourse through radio ads inviting customers to file claims against breached companies, through inboxes flooded with false promises of legal recourse, and via social media platforms where outrage is waiting to be unleashed.

The cyber breach risk for organizations and CISOs has expanded beyond merely attackers and regulators to include legal teams seeking to capitalize on any confusion to build large lists of claimants. Every delay, every overly confident statement from an organization, and every fractured update to customers can become evidence.

Once radio ads and ambulance chasers shape the narrative, the path from confusion to a courtroom and a judge becomes far shorter than most organizations expect.

Unlock more exclusive Cybernews content on YouTube.