Marks & Spencer Confirms Customer Data Stolen in Easter Cyberattack, UK Watchdog Investigates

Marks & Spencer (M&S) has confirmed that personal customer data, including names, email addresses, postal addresses, and dates of birth, was stolen in a sophisticated cyberattack that began around Easter. The retailer emphasized that no payment or card details, nor account passwords, were compromised or shared, and customers will be prompted to reset their passwords for added security. The attack, linked to the hacking group Scattered Spider, has severely disrupted M&S's online operations since April 25, halting website and app orders while stores remain open but face product shortages. M&S's CEO, Stuart Machin, stated there is no need for customers to take any immediate action, but the ongoing cyber chaos has caused operational chaos internally, with the company reportedly lacking a business continuity or cyberattack plan. The incident has drawn scrutiny from the UK's Information Commissioner’s Office and will likely have financial repercussions, with M&S's upcoming annual results being closely watched for impact. Industry experts warn that full recovery could take years, illustrating significant challenges for M&S and other victims like Co-op and Harrods.