Exposed M&S order histories let scammers quote real items, sizes and delivery details to pose as M&S. That familiar detail can make a fake refund, delivery or account message feel legitimate. Marks & Spencer confirmed on 13 May 2025 that attackers stole some personal customer data during the April 2025 incident over the Easter weekend, as described in The Register report on its London Stock Exchange statement. Phishing means fraudulent messages that pose as a trusted company to steal details or money.
Table of Contents
- What happened and who is affected?
- Which details were taken, and which were not?
- Why does order history make fakes convincing?
- What should you do about suspicious M&S contacts?
What happened and who is affected?
M&S said some online customers were affected, with the amount taken unspecified, and it wrote directly to customers. Online shopping was disrupted after M&S paused M&S.com website and app orders from late April 2025 and took some systems offline.
Click & Collect means ordering online and picking up in store. Those online orders and Click & Collect pickups were disrupted for weeks.
Which details were taken, and which were not?
The stolen types could include names, dates of birth, home and email addresses, phone numbers, household information and online order histories, as reported by the BBC via the TechCrunch report. An order history can show what a person bought, when they bought it and where it was sent.
The theft did not include usable payment or card details, which M&S says it does not hold, and did not include account passwords. That limit reduces direct theft from accounts but leaves room for impersonation.
Why does order history make fakes convincing?
A generic scam asks the reader to trust an unknown sender. A message that names a real past purchase, size, store or delivery area skips that doubt.
The UK National Cyber Security Centre has warned that fraudsters use stolen personal data to look credible, including real names and details such as birth month plus phone digits to claim legitimacy. For M&S shoppers, a message saying "about your recent bedding order for home delivery" plus a name and town would follow the same pattern.
What should you do about suspicious M&S contacts?
M&S warned customers to be wary of criminals contacting them pretending to be M&S and asking for account details or passwords, which M&S said it would never request by contact. Treat any call, text, email or social message asking for a password, one-time code or bank details as hostile. UK reporting routes for phishing are direct and quick:.
- forward suspicious emails to [email protected]
- forward suspicious texts to 7726
- report fraud or financial loss to Action Fraud or Report Fraud and your bank promptly, following NCSC and Action Fraud guidance described in the Computer Weekly report
You Might Also Like
- M&S Data Breach: Why an Account Password Reset Does Not Mean Passwords Were Stolen
- M&S Data Breach: What Masked Card Details Mean for Customers
- Legal Aid Agency Data Breach: Why Criminal History and Financial Records Raise Different Risks