And as always
Absence of evidence isn't evidence of absence.
Not that I've ever used Superdrug, but now I know this I will never give them my custom.
I don't care if it was a third party that leaked, the data was entrusted to them.
I hope GDPR can have some impact on their business.