Marks & Spencer data breach
Was I affected?
Marks & Spencer confirmed a breach affecting an undisclosed number of people, exposing names, dates of birth, addresses and phone numbers. Customers with an M&S online account or Sparks membership were emailed by M&S; if you shopped online with M&S before April 2025, assume you may be in scope.
| Announced | May 13, 2025 |
|---|---|
| When it happened | April 2025 |
| Data exposed | Names, Dates of birth, Addresses, Phone numbers, Email addresses and Other details |
| Status | Confirmed by the company or a regulator filing |
What happened
M&S confirmed in May 2025 that customer data was taken in the Easter cyberattack that halted its online orders for weeks. The data may include names, dates of birth, home addresses, phone numbers, email, online order history, household details and masked card details, but not usable card numbers or passwords. The attack was linked to the DragonForce ransomware operation and Scattered Spider-style social engineering.
What should I do?
- Reset your M&S account password when prompted and use a unique password.
- Treat emails, texts and calls that mention M&S, Sparks or refunds as suspect; don't click links or share codes, and contact the company through its official app or website.
- Check your credit file with Experian, Equifax and TransUnion UK, and consider Cifas Protective Registration if you are worried about impersonation.
- Report scams or fraud to Action Fraud (actionfraud.police.uk) or call your bank on the number on your card.
Check the other services you use →
Sources
- Marks & Spencer confirms customer data breach · The Record (news)
- M&S confirms customer data stolen in cyber-attack · Infosecurity Magazine (news)