The Marks and Spencer data breach became public in May 2025, when M&S emailed online customers to say hackers had taken some personal information. The retailer says no usable card details or passwords were stolen. That is reassuring, but names, addresses and dates of birth still help scammers. Many shoppers are asking what exactly was taken, whether they are at risk and what to do next. The story has also developed since the first headlines. This guide explains how the attack unfolded, what data was involved, what it cost and how to protect yourself. It also covers your rights under UK data protection law.
What happened in the Marks and Spencer data breach?
The attack began over the Easter weekend in April 2025. M&S first reported problems with contactless payments and click and collect orders. On 25 April, it stopped taking online orders and took some systems offline to contain the threat.
Stores stayed open, but some shelves ran short of stock. The online clothing and home service stayed closed for weeks. Online delivery orders restarted on 10 June 2025, while click and collect took much longer to return.
On 13 May, M&S confirmed this was more than an IT outage. Some customer data had been taken. The company described the attack as sophisticated, emailed its online customers and reported the incident to the National Cyber Security Centre (NCSC) and the Information Commissioner’s Office (ICO).
What customer data was stolen?
M&S said the stolen information could include:
- Names, email addresses and postal addresses
- Dates of birth
- Online order history
- Household information
- Customer reference numbers linked to M&S credit cards or Sparks Pay
- Masked card details, meaning partial card numbers
M&S stressed that the data did not include usable payment or card details, which it says it does not hold on its systems. It also said no account passwords were taken and that it had no evidence of the data being shared. M&S did not publish how many people were affected. For context, it had 9.4 million active online customers in the year to March 2025.
Why does that matter? Scammers use personal details to make phishing look real. Phishing means fake emails, texts or calls that pretend to come from a trusted company. A message that quotes your name and a recent order is far more convincing than a generic one.
Who was behind the cyber attack on M&S?
M&S has been cautious in public. Its chairman, Archie Norman, told MPs the company believed the ransomware group DragonForce was involved. Media reports have also linked the hacking collective Scattered Spider, which is known for tricking staff into giving access.
Ransomware is malicious software that locks a company’s systems. Criminals then demand payment to unlock them, and often steal data as well.
On 10 July 2025, the National Crime Agency (NCA) arrested four people aged between 17 and 20 over attacks on M&S, the Co-op and Harrods. At the time of writing, we could not find public charges linked to M&S, so treat later claims with care.
How much did the M&S cyber attack cost?
In May 2025, M&S estimated the attack would cut operating profit by about £300 million. It hoped to halve that through insurance and cost control. More than £1 billion also disappeared from its stock market value in the weeks after the attack.
The picture later became clearer. M&S booked about £102 million of one-off costs in the first half of its financial year. It also received a £100 million insurance payout. Reported full-year results put cyber-related costs for 2025/26 at £131.3 million.
What are the ICO and police doing?
The ICO is the UK’s data protection regulator. On 2 May 2025, it confirmed it had received reports from M&S and the Co-op and was making enquiries alongside the NCSC.
Under UK GDPR, organisations must report certain breaches to the ICO within 72 hours of becoming aware of them. Serious failures to protect personal data can bring fines of up to £17.5 million or 4% of global turnover, whichever is higher.
We could not find a published ICO penalty against M&S. Check the ICO website for the latest position, because investigations can take a long time.
How to protect yourself after the M&S data breach
You do not need to panic, but a few sensible steps cost nothing:
- Change your M&S password and any matching password elsewhere. M&S said passwords were not taken, but reuse is risky anyway.
- Turn on two-factor authentication where it is offered.
- Treat unexpected emails, texts and calls with suspicion, even if they mention your name or orders.
- Do not click links in messages. Open the M&S app or type the website address yourself.
- Report suspect emails to and forward scam texts to 7726.
- Check bank and card statements regularly, and tell your provider about anything unfamiliar.
- If you hold an M&S credit card or Sparks Pay, watch for approaches pretending to be your provider.
Real companies rarely demand instant action. Urgency is a classic scam warning sign.
Is it safe to shop with M&S online now?
Online ordering has been running again since June 2025. M&S has also reported more investment in cyber resilience, including bringing more of its technology work in-house.
No retailer can promise zero risk. Still, M&S says it does not hold usable card details on its systems, which limits what thieves could take. Most customers can keep shopping, provided they use a strong, unique password and stay alert to scams. If you feel uneasy, you can pay by credit card, which can offer extra protection under Section 75 for purchases between £100 and £30,000.
What are your rights under UK data protection law?
UK GDPR gives you control over your personal data. You can ask M&S what information it holds about you by making a subject access request. The company must normally reply within one month.
You can also ask for inaccurate data to be corrected, and in some cases deleted. If you are unhappy with how M&S handled your data, complain to the company first. If that fails, you can raise it with the ICO.
Some law firms advertise group compensation claims after breaches like this. Courts decide whether harm has occurred, and outcomes vary. We are not lawyers, so seek independent legal advice before signing up to anything, and be wary of unsolicited calls or texts offering to claim for you.
What the M&S data breach teaches other organisations
Attacks like this often start with people, not code. Scattered Spider, for example, is known for social engineering, which means persuading staff to hand over access. Small businesses face the same risk, only with fewer resources.
Basic habits go a long way: multi-factor authentication, regular staff training, tested backups and a rehearsed incident plan. Suppliers need checking too, since attackers often look for the weakest link in a chain.
M&S’s chairman has since argued that companies should have to disclose major cyber attacks. Whether that becomes policy remains to be seen.
Frequently Asked Questions
Was my password stolen in the M&S data breach?
M&S says no account passwords were taken. Even so, changing your password and turning on two-factor authentication is a sensible precaution, especially if you reuse the same password on other websites.
Were my card details stolen in the M&S cyber attack?
M&S says usable payment or card details were not taken because it does not hold them on its systems. Masked card details, meaning partial numbers, may have been involved.
How do I know if I was affected by the M&S data breach?
M&S emailed online customers about the incident in May 2025. Check your inbox and spam folder. If you are unsure, contact M&S customer services or make a subject access request.
Can I claim compensation for the Marks and Spencer data breach?
Possibly, but nothing is guaranteed. Claims depend on proving harm, and outcomes vary. Speak to an independent solicitor, and ignore unsolicited offers to claim on your behalf.
Conclusion
The Marks and Spencer data breach was a serious test of customer trust. Hackers took names, contact details, dates of birth and order history, though M&S says no usable card details or passwords were stolen. The company put the potential hit at £300 million, and regulators and police continue to look at the wider attacks. For customers, the main risk now is scams. Use strong, unique passwords, switch on two-factor authentication and question every unexpected message. A little caution today keeps your details safer tomorrow.
for more information click here
