If your courier, invoicing provider or email marketing platform gets hacked, your customers’ data can leak even when your own WordPress site is perfectly fine. Yet you are the one who answers to your customers: as the data controller, you have to assess the situation and, in most cases, report it to the ICO within 72 hours. The good news is that a few hours’ work is enough to map out who can see what from your shop.
What happens when the problem isn’t with me, but with my courier or invoicing provider?
A recent example: on 7 August 2026, online fashion retailer About You told its customers in Hungary that a security incident had occurred at one of its external logistics partners. According to the company’s letter, unauthorised persons temporarily gained access to the partner’s systems used to process and deliver orders, and it could not be ruled out that they had viewed or even copied customer data in the process (Telex, in Hungarian).
According to the company, the data involved included first and last names, delivery addresses, email addresses, phone numbers, customer and order numbers, and the list, quantity and price of the products ordered. Passwords and payment details were reportedly not accessed, and the data protection authority was notified (Portfolio, in Hungarian). The investigation was still ongoing when the news broke, and the exact number of affected customers had not yet been confirmed.
This is not a one-off accident but the fastest-growing trend in the field.
According to Verizon’s 2026 Data Breach Investigations Report, a third party is now involved in 48% of breaches — a 60% jump in a single year. (Source: Verizon 2026 DBIR)
The takeaway for you: keeping your own site in good order is necessary, but not sufficient. Your customers won’t contact the courier company — they’ll contact you, and legally, you are the one who has to respond.
Who has access to your online shop’s data?
A typical WooCommerce shop shares customer data with several external systems, usually through a plugin or a REST API key. The same Verizon report finds that 31% of breaches now start with the exploitation of a software vulnerability — in other words, every integration you switch on is one more piece of software that someone has to keep updated (Verizon).
| Integration | Customer data it sees | Risk | What to restrict |
|---|---|---|---|
| Courier (Royal Mail, DPD, Evri) | Name, delivery address, phone number, email, order number | High — a complete delivery profile | Only the data for current shipments; don’t sync your full order history |
| Invoicing / accounting (Xero, QuickBooks) | Name, billing address, VAT number, line items, amounts | High — financial and personal data together | A separate API key with only the permissions invoicing needs |
| Email marketing (Mailchimp, MailerLite) | Email, name, purchasing habits | Medium — large list, many logins | Don’t sync delivery addresses or phone numbers; two-factor authentication on the account |
| Payment provider (Stripe, PayPal, Worldpay) | Transaction data, email; card data stays with them | Lower, but high impact | Never store card data in your own database |
| ERP / stock management | Almost the entire order database | High — the widest access | Only the fields needed; logged, revocable access |
| Live chat / customer service | Name, email, order number, conversations | Medium | Automatic deletion of conversations; limited agent permissions |
| Analytics, remarketing | Behavioural data, possibly a hashed email | Lower | Don’t send raw names and email addresses |
How to build an inventory of integrations and API keys
Set aside a quiet morning and work through this list. You don’t need a developer for it.
• 1. Open WooCommerce → Settings → Advanced → REST API. Here you’ll see every live key: its description, which user it belongs to, its permissions (read, write or read/write) and when it was last used (WooCommerce). • 2. Note down which key belongs to which partner. If you can’t say what a key is for, that in itself is an answer. • 3. Check the last-access date. A key that hasn’t been touched for months was most likely left behind by an integration you no longer use. • 4. Revoke the ones you don’t need with the “Revoke key” button. Let the partner know first, because revoking a live key cuts the connection immediately. • 5. Check your webhooks too, in the same Advanced tab: where (to which URL) your shop sends data, and whether that endpoint is still active. • 6. Go through your plugin list. A plugin that is deactivated but still installed can remain vulnerable — delete anything you don’t use. • 7. Review your users. Only people who still work with you today should have Administrator or Shop Manager rights; delete old agency and developer accounts. • 8. Lock down external accounts too: turn on two-factor authentication in your email marketing platform, your invoicing software and your courier’s admin panel.
When we ran this inventory for one of our clients, a clothing retailer, several live REST API keys turned up, including some left behind by a shipping integration that had been replaced years earlier. Nobody was using them — but anyone could have used them at any time. If you get the feeling that something isn’t right with your site, read how to recognise a hacked WordPress site.
What to do if your partner reports an incident
Step by step, and calmly:
• In the first few hours. Ask for a written account of what happened: which system, when, what data, and roughly how many people are affected. Under UK GDPR, a processor must notify you, the controller, without undue delay after becoming aware of a breach — so hold them to it (UK GDPR, Article 33). • The same day. Revoke and replace the API keys and passwords of the affected integration. Take a backup of the current state — following the 3-2-1 rule — so there is something to go back to during the investigation. • Risk assessment. Even without passwords or payment data, names, addresses, phone numbers and order lists together are a problem: that’s exactly what someone needs to write a convincing, targeted phishing message.
A personal data breach must be reported to the ICO by the controller without undue delay and, where feasible, within 72 hours of becoming aware of it — unless it is unlikely to result in a risk to people’s rights and freedoms. (Source: ICO)
• Within the 72-hour window. Report the breach to the ICO using its online breach reporting service. The report must cover the nature of the breach, a contact point, the likely consequences and the measures you have taken. If you don’t have all the information yet, you can report in phases and add the details later (ICO). • Afterwards. Record the incident in your breach log and, if the risk is high, inform your customers too — clearly, with facts they can hold you to. A well-written notice builds trust; that is also the subject of our article on trust signals for online shops.
How to reduce the data you hand over
Under Article 28 of the UK GDPR, you must have a written contract with each processor. It must set out the subject matter, duration, nature and purpose of the processing, the type of personal data and the categories of data subjects, and state that the partner may act only on your instructions, is bound by confidentiality, and may bring in a sub-processor only with your authorisation (UK GDPR, Article 28). In practice, this comes down to four questions for every partner: What can they see? How long do they keep it? Who do they pass it on to? How will they tell you if something goes wrong?
Then there’s the technical side: if an integration only reads orders, give it a read-only key — WooCommerce handles read and write permissions separately (WooCommerce). At another client, an external marketer still had access to the email marketing account years after their contract had ended; nothing bad happened, but nobody would have known if it had.
And not every breach involves hackers: an email or a parcel sent to the wrong recipient can be a reportable incident too. The fewer places your customers’ data is held, the fewer chances there are for any kind of mistake.
Let’s look together at who can see what in your online shop
You can’t guarantee your partners’ security — but you can control how much data you give them, and make sure you have an answer ready on the day of an incident. At WPShield, we offer a free quick security check: we review your live API keys, webhooks, plugins and user permissions, and show you where there is unnecessary access.
Request it here: wpshield.uk — we’ll talk it through in 15 minutes, so you don’t have to guess.
Frequently asked questions
What happens if the data breach is at my courier or invoicing provider rather than at my shop?
You are still responsible to your customers. In UK GDPR terms, you are the controller, and the courier or invoicing provider is a processor acting on your instructions. If a breach happens on their side, it is up to you to assess the risk, report it to the ICO and — where necessary — inform your customers.
Who has access to my online shop’s customer data?
Usually more parties than you’d think: your courier, invoicing provider, email marketing platform, payment provider, ERP or stock management system, live chat and, to some extent, analytics. Most of them connect through a WooCommerce plugin or a REST API key. You can check the exact list under WooCommerce → Settings → Advanced → REST API and in your plugin list.
What should I do if my partner reports a data breach?
First, get a written record of what happened: which system was affected, when, what data, and roughly how many customers. Then assess the risk, revoke and replace the affected integration’s API keys, and prepare your report to the ICO. Record the incident in your own breach log as well.
Do I have to report it to the ICO if the breach happened at my partner?
Yes — reporting is the controller’s job, which means the online shop. Under UK GDPR, a breach must be reported to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it — unless it is unlikely to result in a risk to individuals. If you don’t have all the information yet, you can report in phases.
How can I reduce the data I share with partners?
Give every integration the narrowest set of data and permissions it needs to do its job. Your courier doesn’t need your full order history, your email marketing platform doesn’t need delivery addresses, and your analytics doesn’t need names and email addresses. For WooCommerce API keys, choose read-only access if the partner doesn’t write back to your shop.
