ManoMano data breach

In January 2026, a hacker stole personal data from ManoMano, claiming approximately 37.8 million accounts across Europe were affected.

A hacker using the alias “Indra” has claimed responsibility online, alleging that approximately 37.8 million user accounts were affected across Europe, including in the UK.

The data exposed includes names, email addresses, phone numbers and customer support conversations, along with attachments and related metadata. ManoMano has confirmed that account passwords were not affected. There is currently no confirmation that payment card details were accessed through this incident.

ManoMano says the data on its own company servers was not modified or tampered with. Upon discovering the breach, the company disabled the relevant subcontractor access, revoked the third party’s permissions to customer data, strengthened access controls and monitoring, and notified the relevant authorities including France’s data protection authority and national cybersecurity agency. Affected customers have been warned to remain vigilant against phishing and social engineering attempts.

ManoMano is a European online marketplace specialising in DIY, gardening and home improvement products. It operates in several countries including the United Kingdom through its UK website manomano.co.uk.

What are your rights?

Under UK GDPR and the Data Protection Act 2018, organisations must put in place appropriate technical and organisational measures to protect personal data. If it is shown that inadequate safeguards led to unauthorised access, and you suffered distress or financial loss as a result, you may be entitled to seek compensation.

Whether a claim is possible will depend on what data was exposed, how the breach occurred, whether appropriate security measures were in place, and whether you suffered financial loss or distress as a result.

Want to know your rights after a data breach? Read our complete consumer guide covering compensation, groups claims, what counts as harm, what to expect and how to protect yourself.

What data breach compensation could you receive?

Whether a formal claim proceeds will depend on whether a regulated UK law firm takes this case forward. If it does, the value of any individual claim will depend on the circumstances of each person affected. Factors that are likely to be relevant include:

  • What data was exposed. Names, email addresses, phone numbers and support communications are all personal data. Support tickets can sometimes contain delivery addresses, invoices or screenshots, depending on what customers shared – increasing the potential sensitivity of the exposed information.
  • Risk of phishing and impersonation. Even without passwords, the detail contained in support conversations gives criminals enough context to craft convincing phishing attempts that reference genuine orders or past queries.
  • Distress and anxiety. Distress caused by the misuse of your personal data is a recognised form of harm that can support a claim independently of financial loss.
  • Financial loss. Any direct financial loss linked to fraud or identity theft resulting from the breach would be relevant to a claim.

Get updates about this data breach and potential claims

Register for updates

What happens when you register?

Updates about the ManoMano data breach. Including major developments, compensation claims or important next steps.

Alerts about other data breaches and consumer claims. Including new group claims and other relevant consumer action.

Our free monthly newsletter. With practical updates on consumer rights, compensation claims and access to justice.

Frequently asked questions

ManoMano is a European online marketplace specialising in DIY, gardening and home improvement products. It operates in several countries including the United Kingdom through its UK website manomano.co.uk. 

Potentially exposed data includes names, email addresses, phone numbers, customer support conversations and any attachments or metadata associated with those interactions. Support tickets may also contain delivery addresses, invoices or screenshots depending on what customers shared. ManoMano has confirmed that account passwords were not affected. There is currently no confirmation that payment card details were accessed.

A hacker using the alias “Indra” has claimed that approximately 37.8 million user accounts across Europe were affected, including customers in the UK. ManoMano has not publicly confirmed this figure. 

Because the breach originated through a third-party customer service platform, those who have contacted ManoMano support at any point are particularly likely to have data included in the compromised dataset.

The attack targeted a third-party customer service provider used by ManoMano rather than ManoMano’s own systems directly.

ManoMano has confirmed that the data on its own company servers was not modified or tampered with. The company says it took immediate steps on discovering the breach, including disabling the relevant subcontractor access and revoking the third party’s permissions to customer data. 

Support tickets often contain contextual detail such as order numbers or delivery and billing discussions.

Criminals can use this information to create targeted phishing emails or impersonation scams that appear legitimate, making this type of breach particularly useful to fraudsters even without passwords or payment data.

No. Registering simply means you will receive updates. If a law firm later takes on the case, you will be given the option to learn more about the process and any potential costs before deciding whether to take part.

Are you affected?

Register for updates about this data breach and potential claims.

Register for updates
You may have been affected by the ManoMano breach if you:
  • Are or have been a ManoMano customer in the UK and have contacted customer support at any point
  • Provided personal details – including your name, email address or phone number – when registering an account or making a purchase
  • Shared information through customer support interactions such as order queries, delivery issues or billing discussions

Because the breach originated through the customer service platform, those who have contacted ManoMano support are particularly likely to have data included in the compromised dataset. ManoMano has said it is notifying affected customers directly.

Registering your interest means you will be kept informed if a regulated UK partner law firm is able to take a claim forward.

Share this…

Data breach claims you can join

  • Legal Aid Agency data breach

    If you applied for legal aid between 2007 and 2025, you could be eligible for a group claim. Register your interest to find out.

  • Capita data breach

    Capita was fined £14m after a 2023 cyber attack exposed millions of people’s data. Register for updates on the ongoing legal action.

  • Facebook data misuse

    Facebook faces a £2.1bn legal claim that alleges it exploited 46m UK users by unfairly profiting from their data. Sign up to stay updated.

Take a look at our Group claims page to see all of our current claims.

  • Southern Water data breach

    On 22 January 2024, Southern Water discovered a cybercriminal claim that data had been stolen from its IT systems. On 12 February 2024, it confirmed that data from a limited part of its servers had been compromised following an illegal intrusion.

  • 23andMe data breach

    Between April and September 2023, a hacker accessed 23andMe using login credentials stolen from previous unrelated data breaches, exposing the personal information of 155,592 UK residents.

  • NHS Synnovis data breach

    In June 2024, criminal hackers stole patient data from Synnovis, a pathology provider serving several NHS hospitals & GP surgeries across south east London.

  • Co-op Member data breach

    In April 2026, Booking.com confirmed that unauthorised third parties had accessed guests’ personal booking information.

  • CarGurus data breach

    In February 2026, CarGurus, the online marketplace used by millions of people to research and buy cars, had its customer data stolen.

  • Booking.com data breach

    In April 2026, Booking.com confirmed that unauthorised third parties had accessed guests’ personal booking information.

  • Lloyds Banking Group breach

    Lloyds, Halifax and Bank of Scotland customers may have had sensitive financial data exposed in the March 2026 breach. Learn your rights.

  • M&S data breach

    M&S data breach. In April 2025, Marks & Spencer experienced a cyber attack that caused widespread disruption across its digital operations.

Latest data breach news