We use cookies to allow us and selected partners to improve your experience and our advertising. By continuing to browse you consent to our use of cookies. You can understand more and change your cookies preferences here.


Yodel cyber 'incident': what you need to know about your returns, deliveries and data

AO, Asos, JD Sports, John Lewis and Very offer a click-and-collect service with the courier firm

Courier firm, Yodel, is experiencing delivery delays following a cyber 'incident' on its network.

A number of big online retailers, such as AO, Asos, JD Sports, John Lewis, M&S, Very and Zara, offer a click-and-collect service with Yodel.

If you're waiting to receive a parcel or have sent your returns via Yodel, you might experience delays with your order getting to you or back to the retailer.

Here, Which? explains your delivery and data rights if you're a Yodel customer.

Be more money savvy

Get a firmer grip on your finances with the expert tips in our Money newsletter – it's free weekly.

This newsletter delivers free money-related content, along with other information about Which? Group products and services. Unsubscribe whenever you want. Your data will be processed in accordance with our Privacy policy

How severe are the delays?

Yodel hasn't given any specific detail on how severe the delays are, but its website warns that deliveries may arrive later than expected.

You can still track your parcel but it's unable to provide exact delivery slots or give detailed information on any pending parcels.

There's more information on Yodel's website.

Some retailers are also contacting customers to explain the impact.

Very, for example, sent an email to its users yesterday stating that a 'small number of customers' were affected and that they would be contacted directly.

Very email about Yodel delays
Very email about Yodel delays

What are my rights if my Yodel parcel is delayed?

When you order a parcel online, your contract is with the retailer, not the courier.

So if your parcel is late or missing, you should complain to the retailer you ordered from rather than Yodel.

If you're waiting for a Yodel parcel ordered with standard delivery, the retailer must get the order to you within 30 days from the point of purchase.

After 30 days has passed, you can ask the retailer for a refund.

But if you paid extra for special delivery with Yodel and your order is held up, you can claim back the extra delivery cost as the service wasn’t delivered as agreed at the checkout.

If you sent a return back via Yodel and it arrives outside the retailers' returns window, we advise sharing your proof of postage with the retailer to confirm you did send it back in good time.

What's happened to my data?

Yodel hasn't released much information about the cyber attack itself but says it's launched an investigation, led by its internal IT division and supported by a digital forensics group, to resolve the situation as quickly as possible.

It's also confirmed that it doesn't hold or process any customer payment information, so your financial data should be safe.

We'll update this page when we hear more detail.

What should I do if my data's been breached?

Yodel advises you to be alert to any unsolicited and unexpected communications that ask for your personal information or refer you to a web page asking for personal information.

Don't respond to, click on links, or download attachments from suspicious email addresses.

If you are asked for personal information by someone purporting to be Yodel employee, don't share this information with them - contact Yodel first to verify that the request is legitimate.

You can also contact Action Fraud, the UK’s national fraud and internet crime reporting centre, if you think you've been contacted by a scammer.

If you had an account with Yodel and use the same or similar login information - such as passwords and usernames - for other websites or online accounts, you should change those details immediately.

In some cases, if your data is lost and it causes you financial damage or distress, you may be also able to make a claim for compensation from the organisation that lost it. But at this stage, it's not clear how severe the cyber attack is.