M&S says household information was among the types of customer data that could have been taken in its April 2025 cyber incident. The customer notice lists it alongside names, email and home addresses, phone numbers, dates of birth and online order histories, as Computer Weekly reported in its Computer Weekly report. Household information here is a label used in that notice for data linked to a customer household. M&S confirmed theft of some personal customer data in its corporate cyber update, but did not publish a customer count or define the household category, as TechCrunch noted.
Table of Contents
- What "household information" means in the notice
- What payment data was involved
- Do you need to reset or change anything?
- How to handle suspicious contacts
What "household information" means in the notice
The notice treats household information as one item in a wider set of contact and account details. It sits next to identifiers such as name, address, phone number, date of birth and order history.
That placement suggests household-level context, not bank details or passwords. Readers should not read more into the phrase than M&S stated. The company has not publicly defined the field, so customers cannot tell from the notice whether it means household size, shared address details or another account marker.
What payment data was involved
Online shoppers had masked card details included in the possible theft. The Register reported in its Register coverage that M&S says those details are not usable because it does not hold full card details. Masked means only part of the number or a hidden version was stored.
Customers with M&S credit cards or Sparks Pay faced a different exposure. SafetyDetectives, describing the M&S notice, said those customers could have had a customer reference number taken, not card numbers or payment details.
Do you need to reset or change anything?
M&S said there is no evidence the stolen data has been shared, it includes no usable card or payment details and no account passwords, so customers need take no action, as ITPro reported in its ITPro summary. That advice covers the data types named in the notice.
As a precaution, M&S is prompting online account holders to reset their password at next login for extra peace of mind, according to London Stock Exchange and Alliance News reporting. Use the normal M&S sign-in page and choose a new, unique password.
How to handle suspicious contacts
Stolen contact details can fuel fake calls, texts and emails that pretend to be M&S. The City Mail, reporting M&S advice, said customers should watch for phishing and know M&S will not ask for usernames or passwords in its City Mail report.
- Pause on urgent messages about your M&S account, refund or order.
- Contact M&S through its own website or app, not links in the message.
- Never share a password, one-time code or full card number.
- Delete the message if the sender pressures you to act fast.
You Might Also Like
- Sparks Pay and M&S Data Breach: Customer Reference Numbers vs. Card Numbers
- Manchester Airports Group Data Breach: What the August 2026 Notice Says Was Taken
- M&S Data Breach: Why an Account Password Reset Does Not Mean Passwords Were Stolen