Marks & Spencer has revealed customers’ personal data was taken by hackers after it was hit by a damaging cyber attack.
The retail giant’s chief executive Stuart Machin said the data had been accessed due to the “sophisticated nature of the incident”.
However he stressed this does not include “usable payment or card details, which we do not hold on our systems”.
There is also no evidence that account passwords have been shared, M&S said.
The company did not say how many customers had been affected but Mr Machin said there was “no need for customers to take any action”.
M&S had 9.4 million active online customers in the year to 30 March, according to its last full-year results.
Cybersecurity experts say the lack of sensitive data being shared “does not mean that customers are not at risk”.
Charlotte Wilson, Check Point’s head of enterprise, said: “Customers should not assume there is nothing to worry about.
M&S has been struggling for weeks after hackers, reportedly from the Scattered Spider group, attacked their networks.
The British retailer was forced to halt recruitment amid the ongoing attack that became apparent on Easter Monday.
Shelves around the country have been bare and customers are unable to shop online.
Agency staff at some distribution centres were also told to stay at home because of the attack.
Last week, an M&S says it could be “months” before the retailer fully recovers – and that the company had no plan for such an incident.
An employee at M&S’s head office, who spoke on condition of anonymity, said it had been “pure chaos” in the wake of the attack.
The Co-op also faced a similar major incident and was forced to apologise after hackers managed to access the data of a “significant number” of past and current members.
In the same week, luxury department store Harrods also suffered an attempted hack and temporarily restricted internet access across its sites as a precautionary measure.
The National Crime Agency has said it is investigating the attacks individually but it is “mindful they may be linked”.
