Yodel cyber 'incident': what you need to know about your returns, deliveries and data

Courier firm, Yodel, is experiencing delivery delays following a cyber 'incident' on its network.

A number of big online retailers, such as AO, Asos, JD Sports, John Lewis, M&S, Very and Zara, offer a click-and-collect service with Yodel.

If you're waiting to receive a parcel or have sent your returns via Yodel, you might experience delays with your order getting to you or back to the retailer.

Here, Which? explains your delivery and data rights if you're a Yodel customer.

How severe are the delays?

Yodel hasn't given any specific detail on how severe the delays are, but its website warns that deliveries may arrive later than expected.

You can still track your parcel but it's unable to provide exact delivery slots or give detailed information on any pending parcels.

There's more information on Yodel's website.

Some retailers are also contacting customers to explain the impact.

Very, for example, sent an email to its users yesterday stating that a 'small number of customers' were affected and that they would be contacted directly.

What are my rights if my Yodel parcel is delayed?

When you order a parcel online, your contract is with the retailer, not the courier.

So if your parcel is late or missing, you should complain to the retailer you ordered from rather than Yodel.

If you're waiting for a Yodel parcel ordered with standard delivery, the retailer must get the order to you within 30 days from the point of purchase.

After 30 days has passed, you can ask the retailer for a refund.

But if you paid extra for special delivery with Yodel and your order is held up, you can claim back the extra delivery cost as the service wasn’t delivered as agreed at the checkout.

If you sent a return back via Yodel and it arrives outside the retailers' returns window, we advise sharing your proof of postage with the retailer to confirm you did send it back in good time.

• Find out more: what to do if your delivery is late or missing

What's happened to my data?

Yodel hasn't released much information about the cyber attack itself but says it's launched an investigation, led by its internal IT division and supported by a digital forensics group, to resolve the situation as quickly as possible.

It's also confirmed that it doesn't hold or process any customer payment information, so your financial data should be safe.

We'll update this page when we hear more detail.

• Find out more: your rights after a data breach

What should I do if my data's been breached?

Yodel advises you to be alert to any unsolicited and unexpected communications that ask for your personal information or refer you to a web page asking for personal information.

Don't respond to, click on links, or download attachments from suspicious email addresses.

If you are asked for personal information by someone purporting to be Yodel employee, don't share this information with them - contact Yodel first to verify that the request is legitimate.

You can also contact Action Fraud, the UK’s national fraud and internet crime reporting centre, if you think you've been contacted by a scammer.

If you had an account with Yodel and use the same or similar login information - such as passwords and usernames - for other websites or online accounts, you should change those details immediately.

In some cases, if your data is lost and it causes you financial damage or distress, you may be also able to make a claim for compensation from the organisation that lost it. But at this stage, it's not clear how severe the cyber attack is.

• Find out more: how data breaches lead to scams