M&S customers warned to be alert following data hack

Attackers stole personal information but not payment details

- MARTYN LANDI

Cyber security experts have urged Marks & Spencer customers to “stay vigilant” for scams and fraud after the retailer confirmed some personal data had been stolen in a cyber attack.

M&S assured customers yesterday that while some data, including names, email addresses, postal addresses and dates of birth, may have been accessed, no payment information, card details, account passwords, or other sensitive data were compromised. The stolen data is also not believed to have been shared online.

Experts say potentially affected customers should still be particularly wary of phishing scams, where criminals pose as official businesses in an effort to get personal and financial information from their victims.

Matt Hull, head of threat intelligence at cyber security firm NCC Group, said that despite the attackers not having accessed financial data or passwords, “threat actors could potentially use the stolen information to launch targeted social engineering attacks”. He added: “Stay vigilant for phishing messages pretending to be from M&S or other companies you’ve dealt with. These attackers might use the leaked M&S information to craft very convincing scams.