M&S Cyberattack Exposes Customer Data, Disrupts Operations

Marks & Spencer (M&S) has confirmed that a cyberattack, which began on April 25, 2025, compromised some customer personal data, including names, addresses, and order histories. However, the company assured customers that sensitive information, such as payment card details and account passwords, was not affected. As a precautionary measure, M&S has advised customers to reset their passwords. The breach was attributed to the hacking group Scattered Spider, and it has disrupted M&S’s online operations, halted orders and affecting product availability in stores.

Despite the challenges caused by the attack, M&S has emphasized that there is no evidence to suggest that the stolen data has been shared. The company is working closely with cybersecurity experts, law enforcement, and government agencies to restore its systems and secure its operations. While M&S continues to work on resolving the situation, the cyberattack has had a notable financial impact, with the company’s stock value dropping by 15% and an estimated profit loss of at least £30 million.

The company is relying on its cyber insurance to cover most of the damages, though the coverage is likely limited to a short period. As M&S works to recover from the attack, this incident highlights the growing challenges retailers face in safeguarding customer data and the ongoing risks associated with cybersecurity threats.