Update: On 13 May 2025, Marks & Spencer confirmed that customer data had been compromised in the cyberattack. You can find out more here.
Marks & Spencer (M&S), one of the UK’s most trusted retailers, is currently responding to a major cyberattack that has forced it to suspend online orders, disable its website and mobile apps, and issue mass refunds. According to reports, a hacking group called Scattered Spider is behind the attack.
While the full scale of the incident is still unfolding, customers across the UK are left asking one critical question: Was my personal data compromised in a M&S data breach?
What we know so far about the Marks & Spencer cyberattack
According to media reports, M&S experienced a “crisis-level” cybersecurity breach over the weekend. As of this week:
- Online and app-based ordering systems are down
- Refunds have been issued for disrupted purchases
- Remote workers have been shut out of IT systems
- The company is working urgently with cybersecurity experts.
No official confirmation has yet been given on whether customer data (names, addresses, contact information, or payment details) was accessed.
What happens if there has been a Marks & Spencer data breach?
If it emerges that personal information has been compromised, affected customers may be entitled to compensation under UK data protection laws. Data breach claims can cover:
- Financial loss from fraud or identity theft
- Emotional distress caused by loss of control over your personal data
- Time and inconvenience spent dealing with the fallout.
We’ve seen similar cases before – and we’re preparing now, in case this becomes one.
What should you do now?
As of yet, there is no indication that customer data has been accessed in the M&S cyberattack. But you don’t need to wait for confirmation before taking action.
If you’re a M&S customer, it’s wise to:
- Monitor your emails and bank accounts for suspicious activity
- Change your password if you reused your M&S login elsewhere
- Watch out for updates. If a data breach is confirmed, we’ll let you know and guide you through your rights.
Join the Claim connects consumers with SRA-regulated lawyers. Visit the claim page to check your eligibility if a claim is open with one of our trusted legal partners. If a group action has not yet been launched, you can register your interest and we’ll keep you informed if a partner firm decides to take a claim forward.
