Marks & Spencer (M&S) confirmed on 13 May 2025 that some personal customer data was taken during the cyber incident that disrupted its online and store operations. The retailer said the information could include names, contact details, dates of birth, household information, order history and masked payment-card details. It said usable card or payment details and account passwords were not included, and that it had no evidence the information had been shared.
The incident was widely reported as a ransomware or extortion attack. M&S itself used the broader term “cyber incident” and has not publicly confirmed the attackers, the full intrusion method or whether a ransom was paid.
What M&S has confirmed
- Some customer data was taken during the 2025 cyber incident.
- The potentially affected information included contact and household details, dates of birth, online order history and masked card details.
- M&S said usable payment details and account passwords were not exposed.
- M&S said there was no evidence that the data had been shared.
- The attack caused extensive disruption to ordering, payments, warehouses and deliveries, with a substantial financial impact.
The company’s wording matters: “some” does not identify a total number of customers, and “could include” does not mean every affected record contained every listed category. No definitive affected-customer count has been publicly disclosed in the company documents available through 2026.
M&S’s original customer update is available at its cyber-incident page.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute#1 Best Overall
- All-Metal Build – This laptop security lock features solid full metal construction for maximum strength and tamper resistance. A reliable laptop security holder for long-term use in public spaces
- Fits 12-18” Laptops – Adjustable width works with MacBook, Surface, and more. This versatile laptop locking station securely holds a wide range of devices
- Key Lock with 2 Keys – The built-in key mechanism keeps your laptop locked to desk. An ideal laptop desk mount for shared workspaces where security matters
- Screen Protection – Soft padding on the middle and both sides protects your laptop screen from scratches. A thoughtful design that makes this laptop lock both safe and gentle.
- Versatile Use – Perfect for schools, libraries, corporate meeting rooms, exhibition halls and open offices. Easy to mount with included screws – your go-to laptop security lock for peace of mind
What happened and when?
| Date | Development |
|---|---|
| 22 April 2025 | M&S disclosed that it was managing a cyber incident and had reported it to authorities. |
| 23 April 2025 | Some operations were moved offline. Contactless payments and Click & Collect were paused. |
| 25 April 2025 | Online orders through M&S websites and apps were paused. |
| 2 May 2025 | The UK Information Commissioner’s Office (ICO) said it had received reports from M&S and the Co-op and was making enquiries with the National Cyber Security Centre. |
| 13 May 2025 | M&S confirmed that some personal customer data had been taken and said passwords and usable payment details were not included. |
| 21 May 2025 | M&S estimated an approximately £300 million impact on 2025/26 operating profit, before mitigation, insurance and trading actions. |
| 27 September 2025 | Half-year results recorded £101.6 million of incident-related costs and said customer-facing systems had been restored during the summer. |
| 19 May 2026 | M&S’s 2026 financial statements said it was still cooperating with the ICO and other regulatory investigations. |
The initial disclosures are recorded in M&S’s regulatory announcement. Operational updates were published in April and May statements and the online-order update.
What information was stolen?
| M&S said data could include | M&S said was not included |
|---|---|
| Customer names | Account passwords |
| Email addresses | Usable card or payment details |
| Postal addresses | Full payment credentials such as a complete card number and security code |
| Telephone numbers | |
| Dates of birth | |
| Online order history | |
| Household information | |
| Masked payment-card details used for online purchases |
M&S’s regulatory filing says the incident did not expose usable card details or passwords: read the filing. Masked card information can help identify a card or transaction, but it is not equivalent to a complete card number, CVV or other immediately usable payment credential.
Rank #2
- Computer lock for HP, Lenovo, Acer, Asus and other brands; not compatible with Dell or Alienware (see part # K68008WW)
- Resettable 4-wheel Number code with 10, 000 possible combinations. Push-button design for one-handed engagement to easily attach lock
- 6’ long carbon steel cable is cut-resistant and anchors to desks, tables, or any fixed structure
- Attaches to laptops, desktops, TVs, monitors, hard drives, docking stations, projectors or any other device featuring a Kensington standard size security slot
- Independently verified and tested for industry-leading standards in torque/pull, foreign implements, lock lifecycle, corrosion, key strength and other environmental condition
Was this definitely a ransomware attack?
News organisations described the event as a ransomware and extortion attack, and the DragonForce operation reportedly claimed responsibility. SecurityWeek’s report covers that context.
M&S’s own public statements refer to a “cyber incident” and do not confirm DragonForce’s identity, the complete attack path or whether a ransom was paid. Those points remain unverified by the company’s disclosures. It is therefore more precise to say that the incident was widely reported as ransomware while separating that reporting from what M&S has directly established.
Recommended Free Tools
Rank #3
- 🎁FIT FOR ALL THE TABLETS: 🎁With an anchor plate, The Hardware cable lock fits for Mac Book and all the Tablets, Smart Phones, such as for iPad, Microsoft Surface, Kindle, Samsung, Android Tablets and phones, etc
- 🎁FIT FOR MOST THE LAPTOPS: 🎁With standard lock, the security cable lock also fits for most laptops that have Standard slots.
- 🎁HOW TO USE: 🎁For Tablets/Laptops without standard lock slot: Bound the anchor plate, which is lined with strong adhesive, to the hard surface of the devices, then insert the locking head into the plate with keys and loop the cable around a fixed object. FOR LAPTOPS WITH LOCK SLOT, just simply insert the lock head into the slot, and loop the cable around a fixed object
- 🎁ANTI THEFT: 🎁The lock head is made of super-strong stainless steel, can be rotated in 360 degrees. The cable is made of cut-resistant twisted steel with a PVC coat, the extra length of 6.5ft fully meets your daily demands
- 🎁MODEL TIPS-- 🎁There are some Models need to be used with I3C Adhesive Security Plate, if you mind using I3C anchor plate, please buy it berofe thinking twice
What customers should do now
M&S originally told customers that no immediate action was required and that they would be prompted to reset their M&S password at their next login. Check the retailer’s official support page for any later instruction. Use the following precautions:
- Go to M&S directly. Type the address into your browser or use the official app. Do not follow a password-reset link in an unsolicited email or text.
- Reset your M&S password when prompted. Make it unique. If you reused it elsewhere, change those accounts too, starting with your email account.
- Expect convincing impersonation attempts. A scammer may know your address, order history or other details. Do not provide passwords, payment information, one-time codes or remote access because a message appears to contain accurate M&S information.
- Check accounts for unusual activity. Review M&S and other important accounts, but do not treat the absence of a fraud alert as proof that your data was unaffected.
- Report suspicious messages. In the UK, forward a suspicious text to 7726 without replying or clicking. If money has been lost, contact your bank through its trusted app or phone number and report the incident to Report Fraud; in Scotland, contact Police Scotland.
- Use free security measures first. A reputable password manager, unique passwords and two-step verification reduce future account-takeover risk. Breach-checking services can provide additional context but cannot prove whether you were affected by this particular incident.
The UK National Cyber Security Centre’s guidance is available at Data breaches and Citizen data breaches.
Rank #4
- 5-Foot (1.5m) Carbon Steel Cable - Resists cutting attempts and provides ample length for easily anchoring your laptop to desks, tables, and other attachment points. Incorporates anti-shearing plastic sleeve to protect surfaces
- Slim Lock Head - Designed to support thin laptops using standard lock slots, lock secures while allowing your device to lie flat and stable
- Resettable 4-Wheel Number Code - Set or reset your personal number code from 10,000 possible combinations
- Pivoting Head and Rotating Anchor - The lock tip rotates 360º and the cable rotates up to 90º—allowing access to the ports near the lock slot on most devices and providing a convenient locking and unlocking experience
- One-Handed Attachment - Convenient slider allows for quick and easy attachment to the laptop with one hand
How the incident disrupted M&S
This was not only a privacy event. To contain the intrusion, M&S disconnected or moved systems offline. The consequences included:
- paused website and app orders;
- paused Click & Collect collections;
- a temporary halt to contactless payments;
- delays to online deliveries;
- disconnected warehouse-management systems; and
- manual forecasting, ordering, replenishment, stock allocation and delivery processes.
Stores remained open, but the loss of connected systems affected how stock moved from warehouses to shops and customers. M&S later said operations and customer-facing systems recovered during the second half of its 2025/26 financial year.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Best Value
- Universal Fit for Diverse Laptops: Our AboveTEK Locking Station is designed to fit a wide range of laptops from 12" to 16", including MacBook, MacBook Air, Surface Pro and Chromebooks. Its adjustable arms accommodate widths from 11.1" to 15.7", ensuring compatibility with various models
- Enhanced Security with Keyed Lock and Long Cable: The AboveTEK MacBook locking comes with a keyed laptop lock and a lengthy 78.7-inch (2m) cable, ideal for securely tethering to any fixed structure. It also includes mounting options for desk attachment, ensuring your laptop stays safe and secure.
- Flexible Viewing and Usage: Equipped with a pivot hinge, our laptop locks and security cables allows for 45° to 125° viewing angles, offering unmatched flexibility in laptop positioning. This feature is ideal for users who value both security and ergonomic comfort.
- Robust and Heat-Dissipating Construction: Built with durable zinc alloy and ABS, our laptop security lock station is designed for longevity. The non-slip surface ensures stability, while its heat-dissipating properties keep your laptop cool during prolonged use.
- Lightweight, Versatile Security:Net weight At only 0.94lb (427g), the AboveTEK Computer Lock offers both portability and robust security. Equipped with dual lock clips (6.8mm & 9.8mm) for various laptop thicknesses, it ensures a secure fit. Ideal for protecting devices in public areas like coffee shops and libraries, it's the perfect blend of convenience and safety.
How much did it cost?
The figures reported by M&S measure different things:
| Figure | What it represents |
|---|---|
| Approximately £300 million | An estimated impact on 2025/26 operating profit announced in May 2025, before mitigation, insurance and trading actions. It was not described as a ransom, fine or single cash payment. |
| £101.6 million | Incident-related costs recognised in the 26 weeks to 27 September 2025, with further costs expected at that time. |
M&S’s later full-year results said sales and profit growth returned in the second half, although the first half had been materially affected. See the 2025/26 full-year results, the half-year results and the original profit-impact announcement.
Regulatory position and unresolved questions
The ICO said on 2 May 2025 that it had received reports from M&S and the Co-op and was making enquiries while working with the NCSC. M&S said it reported the incident to relevant authorities and law enforcement. Its financial statements dated 19 May 2026 said cooperation with the ICO and other investigations was continuing. The ICO statement and 2026 financial statements do not announce a regulatory fine.
Publicly unresolved points include:
- the definitive number of affected customers;
- the exact route used to enter M&S systems;
- the confirmed identity of the attackers;
- whether any ransom was paid; and
- whether stolen information was later published or sold.
“No evidence that the data had been shared” is M&S’s published position at the time of its update. It is narrower than a guarantee that the information can never be distributed.
Bottom line for customers
M&S has confirmed a real theft of some customer information, but its published account does not indicate exposure of usable card credentials or account passwords. The immediate consumer risk is therefore phishing, impersonation and social engineering using details such as addresses or order history. Verify messages through official M&S channels, use a unique password and treat any request for payment details, codes or remote access as suspicious.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
