Masked card details mean partial card numbers that cannot complete a purchase. M&S said attackers took masked details used for online purchases, not full or usable numbers, and no account passwords. Masking hides most digits when a number is displayed. M&S disclosed the incident on 22 April 2025 and paused M&S.com orders on 25 April, according to Grocery Gazette's reopening report, before restoring standard delivery on 10 June after about seven weeks offline.
Table of Contents
- What attackers took from M&S customers
- Why masked numbers cannot make payments
- Why phishing is the larger risk
- What customers should do now
What attackers took from M&S customers
Attackers stole names, email and postal addresses, phone numbers, and dates of birth. The theft also included online order history and household information, according to TechCrunch's 13 May report.
The stolen payment data was limited to masked card details from online purchases. M&S said no account passwords were taken, according to The Register's 13 May report.
Why masked numbers cannot make payments
Card masking shows only part of a number, such as first digits and last digits. Payment-industry practice described by the PCI Security Standards Council allows at most the first six and last four digits to remain visible, so the hidden middle digits block a purchase.
An M&S spokesperson clarified the limit by saying the company does not hold full card details, so the stolen data was masked and not usable for payments. Treat any message asking you to "complete" payment with those details as suspicious.
Why phishing is the larger risk
The stolen contact, birth-date, and order-history details can make fake M&S messages look convincing. An attacker can address you by name, cite a real past order, and link to a fake login or delivery page.
That personal context raises trust without needing your full card number. Watch for urgent delivery problems, password resets you did not request, and links that do not go to the normal M&S site.
What customers should do now
Check bank and card statements for unfamiliar M&S or retail charges. Do not enter card or login details from an unexpected email or text. Forward suspect emails to [email protected] and suspect texts to 7726, following UK ICO and NCSC guidance.
- Delete unexpected M&S emails and texts without clicking links
- Open M&S.com directly by typing the address yourself
- Monitor statements for small test charges and unfamiliar merchants
- Change your M&S password separately if you reused it elsewhere
You Might Also Like
- Legal Aid Agency Data Breach: What Providers Should Know About Bank Account Details
- Medical Data Breach: Protecting Insurance and Patient Accounts
- Lemonade Insurance Data Breach: When Can You Activate Settlement Credit Monitoring?