Marks & Spencer has issued a warning to customers to remain vigilant against scam emails and phone calls following a cyber attack that stole personal data.
The retailer is contacting affected customers this week to confirm that hackers accessed sensitive information, including contact details, dates of birth, order histories, and partially masked credit card numbers—typically the last four digits.
While these masked details can’t be used to make payments directly, M&S cautioned that scammers could exploit them to deceive individuals into revealing their full card information.
The company urges customers to be cautious of unsolicited messages and report any suspicious activity immediately.
Marks & Spencer has warned customers to be on alert for scam messages following a cyber attack that resulted in the theft of personal information, including contact details and partial payment data.
Jayne Wall, M&S’s operations director, advised customers not to share personal details with unknown callers. “You do not need to take any action, but you might receive emails, calls or texts claiming to be from M&S when they are not, so do be cautious,” she said.
Wall stressed that M&S would never ask for sensitive information such as usernames or passwords. “Importantly, the data does not include useable card or payment details, and it also does not include any account passwords,” she added.
The retailer clarified that it does not store full card numbers on its systems—only “masked” data, such as the last four digits.
Stolen information is believed to include names, phone numbers, addresses, dates of birth, and customer reference numbers.
M&S has contacted millions of customers—particularly those in its Sparks loyalty programme and anyone who has shopped online—urging them to be vigilant and consider resetting their passwords. The company has not disclosed the total number of customers affected.
