M&S Cyber Attack: What Customers Should Do
Marks & Spencer confirmed that some customer information was stolen in the April 2025 attack. Here is what it said was taken, what was not, and what to do.
By Siddharth ShankarUpdated October 19, 2026M&S said that some personal customer information was taken in the cyber attack on April 22, 2025. It listed names, email and home addresses, phone numbers, dates of birth, online order history and masked card details, and said the data did not include usable card or payment details or account passwords. M&S said customers did not need to act on the stolen data, but asked active account holders to reset their password. The main risk is convincing scam emails, calls and texts.
Your email may already be in a known data breach. Find out in about 30 seconds.
Free · About 30 seconds · No sign-up · Email not stored
Marks & Spencer is one of the best-known retailers in the UK, so many people had an account without thinking much about it. If you shopped online or used a Sparks card, this incident may concern you. The facts below come from what M&S told customers and from press reports of its statement.
What happened
According to BleepingComputer’s report of the M&S statement, the attack took place on April 22, 2025. On May 13, 2025, chief executive Stuart Machin confirmed that some personal customer information had been taken.
What M&S said was taken
The M&S customer FAQ, as reported, listed these types of information:
- Full name
- Email address
- Home address
- Phone number
- Date of birth
- Online order history
- Household information
- Sparks Pay reference numbers
- Masked payment card details
What M&S said was not taken
M&S said the data did not include usable card or payment details, or account passwords. A spokesperson said card details were obfuscated in line with industry rules. M&S also said there was no evidence at that time that the information had been shared.
Do not guess. See which breaches include your email and what leaked.
Free · About 30 seconds · No sign-up · Email not stored
What M&S asked customers to do
M&S said customers did not need to take action regarding the stolen data. However, all customers with active accounts would be asked to reset their password the next time they logged in to the website or app. Do this even if you think your password is strong, and never reuse that password anywhere else.
The real risk: scams that sound right
Names, addresses, dates of birth and order history are exactly what scammers use to sound convincing. M&S warned that you might receive emails, calls or texts claiming to be from M&S when they are not, and said it would never ask you for your password.
1Do not click links in unexpected messages
Go to the M&S website or app by typing the address yourself.
2Never share a password, one-time code or full card number
Genuine staff do not ask for these.
3Forward suspicious emails and texts
In the UK, forward emails to report@phishing.gov.uk and texts to 7726.
4Check your credit file
A date of birth and address can be used to apply for credit. Review your file with the UK credit reference agencies and consider asking about protective registration if you see anything odd.
Help for relatives
Older relatives are often the target of scam calls that quote real details. Tell them that M&S said it would never ask for a password, and that a caller who does is not genuine.
Reduce the damage from future leaks
You cannot control how a company stores data, but you can limit what a leak gives away. Use a different password on every site, avoid giving a real date of birth where it is not required, and use an alias for shop sign-ups. Our guide to what to do if your phone number was in a data breach covers the phone side of the risk.
M&S may update its advice, so check its official customer pages for the latest information.
Sources
- BleepingComputer: M&S says customer data stolen in cyberattack, forces password resets (April 22 2025 attack, data types, no usable card details or passwords, password reset, scam warning)
Frequently asked questions
Was my M&S password stolen?
M&S said the stolen data did not include account passwords. It still asked active account holders to reset their password at next login.
Were my card details stolen?
M&S said the data did not include usable card or payment details and that card details were masked in line with industry rules.
What personal data did M&S say was taken?
It listed name, email, home address, phone number, date of birth, online order history, household information, Sparks Pay reference numbers and masked card details.
Do I need to do anything about the stolen data?
M&S said no action was needed on the stolen data, but you should reset your password and stay alert for scams using your details.
How do I report a suspicious M&S message?
Forward emails to report@phishing.gov.uk and texts to 7726. Do not click links or call numbers in the message.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Change reused and leaked passwords
NordPass flags weak and reused passwords, and its Premium plan alerts you if your details appear in new breaches.
See NordPass →Affiliate link. We may earn a commission at no extra cost to you.
Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.