Not upheld: data breach and inadequate remedy complaint against Lantern Debt Recovery Services Limited

Decision detail

Summary

Mr C complained that Lantern Debt Recovery Services Limited had not done enough to remedy a data breach in April 2025 that affected his personal information. Mr C sought compensation for distress caused by the breach and questioned whether a debt write-off was a goodwill gesture related to the breach. Lantern offered a complimentary twelve-month credit monitoring and fraud protection service as remedy and explained the debt was written off due to its age, not the breach. The ombudsman found that Lantern's monitoring service was comprehensive and appropriate, that the incident was contained quickly with no evidence of actual data misuse, and that Mr C had not provided evidence of fraudulent account applications as claimed. The complaint was not upheld.

The Ombudsman's reasoning

The ombudsman assessed whether Lantern had done all they could to put Mr C back in the position he would have been in but for the incident. The ombudsman found that the incident was contained quickly, was a ransomware attack targeting Lantern's business rather than individual data, and there was no evidence of actual misuse of Mr C's data. The comprehensive credit monitoring service with online scanning, alerts, and specialist support was found to be the most appropriate remedy to protect Mr C from future harm and worry, more so than a monetary award. The ombudsman could not award compensation for hypothetical future harm and found no evidence of new fraudulent account applications despite Mr C's concerns.

How this compares

Source

Read the original decision on the Financial Ombudsman Service website