M&S data breach

In April 2025, Marks & Spencer experienced a cyber attack that caused widespread disruption across its digital operations.

Online and app-based ordering was suspended, Click & Collect was paused and contactless payments were taken offline in many stores. M&S moved some systems offline to protect its network, staff and customers while working with cybersecurity experts to contain the incident.

For several weeks M&S maintained there was no evidence that customer data had been compromised. On 13 May 2025, the company confirmed that customer data had in fact been accessed. The stolen information includes names, contact details and potentially other personal data. M&S has confirmed that payment card details and account passwords were not among the information accessed.

The attack has been linked to a hacking group known as Scattered Spider, who used social engineering tactics, including impersonating employees, to infiltrate M&S’s internal systems. The ransomware used was provided through a group called DragonForce, which operates a ransomware-as-a-service model. Reports indicate the hackers gained entry through a third party with access to M&S’s systems. In July 2025, four people were arrested in connection with the attack.

What are your rights?

Under UK GDPR, M&S had a legal obligation to protect customer personal data and to notify affected customers without undue delay when a breach occurred. The delay between the attack and the public confirmation of the data breach raises questions about whether that obligation was fully met.

You do not need to have lost money to make a claim, it could be due to several factors such as financial losses linked to fraud or identity theft, emotional distress and anxiety, and time and inconvenience spent dealing with the consequences of the breach.

You also have the right to ask what data was exposed and how the incident occurred. Consumers can also complain to the Information Commissioner’s Office (ICO), whether or not they choose to pursue a compensation claim.

Want to know your rights after a data breach? Read our complete consumer guide covering compensation, groups claims, what counts as harm, what to expect and how to protect yourself.

What data breach compensation could you receive?

There is no fixed amount for data breach compensation. The value of a claim depends on the type of data exposed, the distress caused and whether you suffered any downstream harm such as fraud or identity theft attempts.

Factors that affect the amount include:

  • Financial losses. Any losses linked to fraud or identity theft resulting from the breach can form the basis of a material damages claim.
  • Emotional distress and anxiety. Distress caused by the misuse of your personal data is a recognised form of non-material harm and can support a claim independently of any financial loss.
  • Time and inconvenience. Time spent dealing with the consequences of the breach, including handling suspicious communications, changing passwords or monitoring accounts, can be included.
  • Phishing and ongoing risk. Cybersecurity experts have warned that stolen data is likely to be sold and used to craft convincing phishing scams. Any fraud or financial loss resulting from such activity would strengthen a claim further.

Get updates about this data breach and potential claims

Register for updates

What happens when you register?

Updates about the M&S data breach. Including major developments, compensation claims or important next steps.

Alerts about other data breaches and consumer claims. Including new group claims and other relevant consumer action.

Our free monthly newsletter. With practical updates on consumer rights, compensation claims and access to justice.

Frequently asked questions

M&S has confirmed that names, contact details and potentially other personal information were accessed. The company has stated that payment data and passwords were not among the compromised details.

No. M&S has confirmed that payment card details and account passwords were not among the data accessed.

M&S maintained for several weeks following the attack that there was no evidence of customer data being compromised, before confirming the breach on 13 May 2025. Under UK data protection law, organisations are expected to notify customers without undue delay when personal data has been exposed. This delay may have left affected customers unable to take swift protective action.

Register your interest using the form on this page. This is free and does not commit you to anything. You will be kept informed as the claim develops and can decide whether to formally proceed when prompted.

Be alert to phishing emails, calls or texts claiming to be from M&S. The company has confirmed it will never contact you to ask for your password or personal account information. Monitor your bank statements for suspicious activity and, if you used your M&S password on other accounts, update those passwords and enable two-factor authentication where possible.

Yes. In July 2025, four people were arrested in connection with the M&S data breach.

Are you affected?

Register for updates about this data breach and potential claims.

Register for updates
You may have been affected by the M&S data breach if you:
  • Are or have been an M&S customer and had an online account prior to the breach
  • Received a direct notification from M&S confirming your data was part of the breach
  • Shop online with M&S or use the M&S app and provided personal contact details when registering

M&S has said it has contact affected customers directly with more details. If you receive a notification of your involvement in the data breach, you could be eligible to join a compensation claim.

You do not need to have suffered fraud or financial loss to be eligible. The delay in M&S confirming the breach, maintaining for weeks that no data had been compromised, may have left affected individuals without the opportunity to take swift protective action, and this is relevant to any claim.

Share this…

Data breach claims you can join

  • Legal Aid Agency data breach

    If you applied for legal aid between 2007 and 2025, you could be eligible for a group claim. Register your interest to find out.

  • Capita data breach

    Capita was fined £14m after a 2023 cyber attack exposed millions of people’s data. Register for updates on the ongoing legal action.

  • Facebook data misuse

    Facebook faces a £2.1bn legal claim that alleges it exploited 46m UK users by unfairly profiting from their data. Sign up to stay updated.

Take a look at our Group claims page to see all of our current claims.

  • Southern Water data breach

    On 22 January 2024, Southern Water discovered a cybercriminal claim that data had been stolen from its IT systems. On 12 February 2024, it confirmed that data from a limited part of its servers had been compromised following an illegal intrusion.

  • 23andMe data breach

    Between April and September 2023, a hacker accessed 23andMe using login credentials stolen from previous unrelated data breaches, exposing the personal information of 155,592 UK residents.

  • NHS Synnovis data breach

    In June 2024, criminal hackers stole patient data from Synnovis, a pathology provider serving several NHS hospitals & GP surgeries across south east London.

  • ManoMano data breach

    In January 2026, a hacker stole personal data from ManoMano, claiming approximately 37.8 million accounts across Europe were affected.

  • Co-op Member data breach

    In April 2026, Booking.com confirmed that unauthorised third parties had accessed guests’ personal booking information.

  • CarGurus data breach

    In February 2026, CarGurus, the online marketplace used by millions of people to research and buy cars, had its customer data stolen.

  • Booking.com data breach

    In April 2026, Booking.com confirmed that unauthorised third parties had accessed guests’ personal booking information.

  • Lloyds Banking Group breach

    Lloyds, Halifax and Bank of Scotland customers may have had sensitive financial data exposed in the March 2026 breach. Learn your rights.

Latest data breach news