If you had an M&S credit card or Sparks Pay, attackers stole your customer reference number, not your card number. M&S says those reference numbers are not payment details and the breach includes no usable card details. A reference number identifies the account inside M&S; a card number moves money.
M&S Corporate said in April 2025 it was handling a cyber incident that hit online orders and stores over the Easter weekend of April 20-21. On May 13, 2025, M&S confirmed attackers stole some personal customer data. BleepingComputer reported in its BleepingComputer report that stolen data can include names, addresses, phone numbers and dates of birth. It can also include online order histories and household information.
Table of Contents
- What did Sparks Pay users lose?
- Why does the difference matter?
- Why force a password reset?
- What should customers watch for?
What did Sparks Pay users lose?
SecurityAffairs, citing M&S, noted in its M&S breach report that current and former M&S credit-card and Sparks Pay holders may have lost reference numbers. That loss sits on top of names, contact details and order history. M&S said those reference numbers are not credit-card numbers or payment details.
The breach does not include usable card or payment details. CyberInsider, citing the M&S FAQ, explained in its M&S data-theft analysis that stolen masked card details were only partial numbers. M&S does not hold full payment-card details on its systems.
Why does the difference matter?
A customer reference number points to an account in M&S records. It does not authorize a payment by itself. A full card number does.
You cannot replace a reference number the way you replace a lost card. That persistence makes the contact and order details around it more useful for fraud. M&S and Bitdefender analysis therefore advise vigilance against phishing that reuses those details.
- Customer reference number: internal identifier for a credit or Sparks Pay record; cannot charge purchases alone.
- Full card number: payment credential that can fund transactions with other checks.
- Masked card detail: partial or obscured digits; not enough to pay.
Why force a password reset?
ComputerWeekly reported in its password-reset report that account passwords were not included in the theft. M&S still forced online customers to reset passwords at next login. It acted as a precaution, not because passwords leaked. A reset closes a simple path back into accounts.
It matters because attackers already hold valid emails, addresses and order histories. Customers should enter a fresh, unique password at that prompt. A reset does not erase the stolen reference number or contact details. It only protects the online login.
What should customers watch for?
M&S and Bitdefender analysis advise vigilance because stolen contact and order details enable targeted phishing. A fake message can quote real history to look legitimate.
Treat personal details in a message as context, not proof of sender. Do not use the link or attachment in an unexpected message. Type the M&S address yourself and check orders inside your account before acting.
- Message quotes a real past order, address or birth date to earn trust.
- Message urges quick login, payment update or refund claim through a link.
- Sender looks close to M&S but asks for a full card number or password.
You Might Also Like
- M&S Data Breach: What Masked Card Details Mean for Customers
- M&S Data Breach: Why an Account Password Reset Does Not Mean Passwords Were Stolen
- M&S Data Breach: How Exposed Order History Could Make Scam Messages Convincing