M&S says customer data stolen in cyberattack, forces password resets

Marks & Spencer confirmed a ransomware attack on April 22, 2025 attributed to DragonForce affiliates using Scattered Spider social engineering; attackers encrypted VMware ESXi virtual machines and stole customer personal information (full names, emails, home addresses, phone numbers, dates of birth, order history, household information, Sparks Pay reference numbers and masked card details). The breach disrupted operations across 1,400 stores, caused a pause to online ordering and prompted mandatory password resets for active accounts; M&S says there is no evidence of usable card/payment data or passwords being exposed and is notifying affected customers.