Join The M&S Data Breach Claim

In April 2025 M&S was victim to a cyber incident that caused severe disruption to its operations, and included a substantial amount of sensitive customer data falling into the hands of cyber criminals.

M&S confirmed that the information accessed included customers names, dates of birth and online order history. The breach did not include passwords or usable payment information.

M&S Operations Director Jayne Wall released the following message to customers in the wake of the cyber attack:

““Dear customer,

I’m Jayne Wall, and I look after Customer Service here at M&S. I am sure that you will have seen in the news that we have been dealing with a cyber incident and I wanted to write to you about what this means for you.

What has happened?

To proactively manage the incident, we immediately took steps to protect our systems and engaged leading cyber security experts. We also reported the incident to relevant government authorities and law enforcement, who we continue to work closely with.

Unfortunately, the nature of the incident means that some personal customer data has been taken, but there is no evidence that it has been shared. The personal data could include contact details, date of birth and online order history. However, importantly, the data does not include useable card or payment details, and it also does not include any account passwords. For more detail, see our FAQs.

How does this affect me and what should I do?

You do not need to take any action, but you might receive emails, calls or texts claiming to be from M&S when they are not, so do be cautious. Remember that we will never contact you and ask you to provide us with personal account information, like usernames, and we will never ask you to give us your password.“

“We sincerely apologise for any inconvenience caused to you and all of our customers.“

M&S should be in touch to notify affected individuals.

Anyone who thinks they might be involved should take immediate steps to protect themselves. Find out how to do this here:

If you receive notification that you are affected by the M&S data breach, register to receive updates on our investigation. We’ll let you know what’s happening, and if and when you can make a data breach compensation claim.

A group action claim is where a group of people – sometimes even thousands of people – have been affected by the same issue. Group action cases are also known as class actions, multi-claimant, or multi-party actions.

There are no costs to join our claim. However, if your claim is successful, you may have to pay a ‘success fee’. This fee is taken from the compensation awarded to you. At KP Law, our success fee is competitive, and we make sure you are fully informed about any potential costs before you officially join our action. If you lose, you won’t have to pay a penny.