A text quoting your exact birthday is not proof it came from Marks & Spencer (M&S), the British clothing and food retailer. Scammers can copy that detail from data stolen in the April attack and reuse it in fake emails, texts or calls. Marks & Spencer confirmed on 13 May 2025 that attackers stole some customers' personal data, as described in the M&S update reported by TechCrunch. Only a subset of customers was affected, and M&S wrote to those customers directly.
Table of Contents
- What did the attackers take?
- Why does a correct birthday fool people?
- Does "no evidence of sharing" mean the data is safe?
- How do you check a suspicious message?
What did the attackers take?
The stolen data could include names, email and postal addresses, phone numbers and dates of birth. It could also include online order history, household information and masked payment-card details. The M&S customer notice, reported by The Stack report on the M&S notice, lists those items as potentially affected.
M&S said the theft did not include usable payment or card details, which it says it does not hold. It also said account passwords were not taken. The company did not publish a total number affected.
Why does a correct birthday fool people?
A correct birthday feels private, so readers treat it as identity proof. Criminals holding the M&S dataset can now insert your real name, address, order history and birthday into a scam.
Sender names offer no protection because email and SMS senders are easy to fake. The UK National Cyber Security Centre warns that a familiar brand name or personal detail does not prove a message is genuine.
Does "no evidence of sharing" mean the data is safe?
M&S said there was "no evidence" the stolen data had been shared. That phrase means none was detected at that time.
It does not guarantee the data will stay unused. Stolen personal data can be kept, sold or used for scams months later.
How do you check a suspicious message?
Stop before clicking links or calling numbers in an unexpected message. Open M&S through its official website or app by typing the address yourself.
That separate route avoids fake links. The National Cyber Security Centre advises these steps for unexpected shopping messages, described in its online shopping guidance:.
- Do not click links in unexpected emails or texts.
- Verify the claim through the official website or app.
- Forward suspect emails to [email protected] and suspect texts to 7726.
You Might Also Like
- M&S Data Breach: Why an Account Password Reset Does Not Mean Passwords Were Stolen
- Sparks Pay and M&S Data Breach: Customer Reference Numbers vs. Card Numbers
- M&S Data Breach: What the Customer Notice Says About Household Information