M&S prompted every M&S.com customer to reset their password as a precaution, not because attackers stole passwords. Finextra, reporting M&S's stock-exchange update, said the taken data did not include any account passwords Finextra's report on the M&S update. Ransomware is malicious software that encrypts company systems and blocks access. BleepingComputer reported M&S detected such an attack on 22 April 2025 that encrypted servers and disrupted 1,400 stores BleepingComputer's 13 May report.
Table of Contents
- What customer data was taken?
- Why force a reset if passwords were safe?
- Does no evidence of sharing mean no risk?
- How to handle emails, calls and texts claiming to be M&S
What customer data was taken?
M&S confirmed on 13 May 2025 that some customer personal data was taken and said it wrote directly to customers. The Register reported the data could include names, dates of birth, home and email addresses, and phone numbers The Register's 13 May report.
It could also include household information, online order histories, masked card details and Sparks Pay references. M&S said the taken data did not include usable payment or card details, which it does not hold. M&S distinguished those masked references from usable payment details.
Why force a reset if passwords were safe?
M&S said customers did not need to take action. ITPro reported customers would still be prompted to reset their M&S.com password on next website or app login ITPro's report on the incident. M&S described the reset as for extra peace of mind and as a precaution.
A precautionary reset limits damage if login details were exposed elsewhere or reused. It does not prove the old password was copied or usable by attackers. M&S suspended M&S.com online orders from 25 April while it contained the attack.
Does no evidence of sharing mean no risk?
M&S said there was no evidence the taken information had been shared. That describes findings at that time, not a guarantee about later sharing or fraud.
Stolen contact and order details can support phishing even without passwords or payment data. M&S reported the incident to data-protection authorities and the National Cyber Security Centre. The ICO told the BBC it was assessing the information provided.
How to handle emails, calls and texts claiming to be M&S
M&S warned customers to be cautious about fake emails, calls or texts claiming to be M&S. Attackers can reuse names, addresses and order histories to sound convincing.
Treat every unexpected contact as suspicious. Never share account details or passwords with a caller or message sender.
- be cautious about any message claiming to be M&S
- never share account details
- never share passwords
You Might Also Like
- M&S Data Breach: What Masked Card Details Mean for Customers
- Website Outage vs. Data Breach: Why Downtime Alone Does Not Establish Data Theft
- Legal Aid Agency Data Breach: Why You Should Not Search for Copies of Leaked Case Files