Marks & Spencer (M&S) has revealed that hackers accessed customers’ personal data in a major cyber-attack, which has disrupted operations for weeks.

The British retailer confirmed that stolen information may include contact details, dates of birth, and online order history – but assured customers that no usable payment details or account passwords were compromised.

In a statement, Jayne Wall, director of central store operations said: ‘…the nature of the incident means that some personal customer data has been taken, but there is no evidence that it has been shared. The personal data could include contact details, date of birth and online order history. However, importantly, the data does not include useable card or payment details, and it also does not include any account passwords…

‘You do not need to take any action, but you might receive emails, calls or texts claiming to be from M&S when they are not, so do be cautious. Remember that we will never contact you and ask you to provide us with personal account information, like usernames, and we will never ask you to give us your password.’

The statement concludes by saying that M&S account holders will be prompted to change their password the next time they log in.

The attack, reportedly linked to the hacking group Scattered Spider, forced M&S to shut down online shopping and left store shelves empty in some locations. The company has also paused recruitment as it works to restore systems.

CEO Stuart Machin reiterated the message on LinkedIn, apologising for the disruption but confirming stores remain open.

He said: ‘As we continue to manage the current cyber incident, we have written to customers today to let them know that unfortunately, some personal customer information has been taken.

Recommended reading

• 60% of Businesses Anticipating a Cyber-breach in 2025
• VPN Security Fears Pushing Firms To ‘Zero Trust Everywhere’
• Growing Adoption of Zero-trust and Multi-cloud Environments

“Importantly, there is no evidence that the information has been shared and it does not include usable card or payment details, or account passwords, so there is no need for customers to take any action.

“Everyone at M&S is working around the clock to things back to normal for our customers as quickly as possible, and we are very sorry for any inconvenience they have experienced. Our stores remain open as they have throughout.”