UK contractor insurance company Qdos reports data breach exposing customer data

Qdos, a UK business insurance and employment status specialist is reporting a security incident affecting its mygoqdos.com web application. 

The security incident was discovered on June 19, 2025, when Qdos became aware of unauthorized activity on its mygoqdos.com web application platform. The company launched an investigation with the assistance of third-party cybersecurity experts. The investigation confirmed that an attacker successfully downloaded customer personal information and sensitive business documents, exposing thousands of contractors' confidential data including insurance policies and IR35 service documentation. 

Exposed data includes

• Personal customer account information including names, correspondence addresses, registered business addresses, email addresses, and contact details
• Insurance policy documents and schedules
• IR35 service documents including contracts, contract reviews, and IR35 compliance calculations
• Purchase-related documents including invoices and credit notes
• Business correspondence and communications

The nature of the attack and the number of affected individuals is not disclosed. Qdos claims that it was not a ransomware attack.

The company has notified relevant regulatory authorities and is offering affected customers 12 months of free identity monitoring services.