M&S Told Customers Personal Data Was Taken. Passwords Were Not.
The useful sentence in the May 13 update is specific. Some personal data was taken. Usable payment details and account passwords were not.
Marks & Spencer reported a cyber incident on April 22, 2025. On April 23 the company said stores stayed open and customers could still use the website and app, while contactless payments, store collection of Click & Collect, and some delivery times were disrupted. On May 13, M&S said it was writing to customers because some personal customer data had been taken.
The May 13 statement is careful. The data does not include usable payment or card details, which M&S said it does not hold on its systems, and it does not include account passwords. M&S said there was no evidence the data had been shared, told customers there was no need to take action, and said they would be prompted to reset passwords the next time they signed in.
Read the sentence you were given
Retail incidents attract rumors faster than they attract primary documents. If you operate stores, clinics, or a membership brand, brief from the company's own update. "Personal data was taken" is not the same sentence as "cards and passwords were taken." M&S drew that line in public. Your incident notes should be that precise.
The device lesson is adjacent, not identical. Store managers and support staff keep customer lists on laptops and handhelds. A help-desk reset, which M&S used as a precaution, is also a moment when attackers try to talk their way into a new password. That is the subject of the June note on the wider UK retail incidents. DriveStrike does not unwind a retailer's central incident. It gives you wipe and lock if one of those handhelds or laptops goes missing while everyone is looking at the website.
Use this as a template
- Say what was taken, and say what was not, if you know.
- Separate "reset your password as a precaution" from "your password was stolen."
- Check the laptops your support team used while the incident was open. Those machines saw more sensitive screens than usual.
Contact Spearstone if you want a device plan that can run beside a corporate incident, or try DriveStrike on the endpoints you issue.
Keep reading
- The First Hour After a Laptop Goes Missing
- UK Retail's Spring Attacks Started Where Help Desks Get Talked Into a Reset
Questions worth answering directly
What did M&S say was taken?
On May 13, 2025, M&S said some personal customer data had been taken. It said the data did not include usable payment or card details or account passwords, and that it had no evidence the data had been shared.
When did the incident become public?
M&S reported the cyber incident on April 22, 2025, and published an operational update on April 23.