Marks & Spencer (M&S) has become the latest major UK retailer to suffer a significant data breach, with reports confirming that personal customer information has been stolen in a recent cyber attack. For millions of customers, this news is understandably concerning and it may be just the beginning.
At Thompsons Solicitors Scotland, we are specialist data breach solicitors, committed to helping individuals protect their rights and pursue compensation for the loss and misuse of their personal information.
What Happened at M&S?
The cyber attack, which occurred around the Easter weekend, disrupted services and forced the suspension of online orders from 25 April 2025. Although in-store services have resumed, the M&S website and app remain offline.
M&S confirmed that hackers had accessed a range of personal data including:
- Full names
- Dates of birth
- Telephone numbers
- Home and email addresses
- Household information
- Online order histories
Crucially, while no full payment details or passwords were stolen, the level of data accessed still poses a serious risk of identity theft and fraud, particularly if sold or leaked on the dark web.
How Serious Is the Risk?
Although M&S states there is currently no evidence that the stolen data has been shared, the nature of the attack suggests this could change.
The cyber crime group DragonForce, believed to be behind the breach, is known for using double extortion methods stealing data, encrypting it, and then demanding ransom payments. If victims don’t comply, the stolen data may be leaked to other cyber criminals, increasing the risk of further exploitation.
With over 9 million active online customers, the potential scale of this breach is huge and the distress and anxiety it causes should not be underestimated.
What Are Your Rights and What Can You Do?
If you’ve received an email or notification from M&S about this breach, or if you’re concerned your personal information may have been compromised, you may be entitled to compensation for:
- Distress, anxiety, or psychological harm
- Financial losses (now or in future)
- Time spent resolving issues or securing accounts
- Increased risk of fraud or identity theft
Why Choose Thompsons Solicitors Scotland?
At Thompsons, we are highly experienced in data breach claims and GDPR cases. We act solely on behalf of individuals and we fight to secure the maximum compensation available for every client.
- Trusted by clients across Scotland
- Experts in data breach and privacy law
- No win, no fee
- Compassionate, confidential legal support
The types of data breach compensation we work on include, but are not limited to:
- Arnold Clark data breach
- South Lanarkshire data breach
- easyJet data breach
- Capita data breach
- Zellis data breach
- Alexander Dennis data breach
- M&S data breach
- JD Sports data breach
- DHL data breach
- Samsung data breach
Talk to Thompsons Today
If you've been affected by the M&S data breach or any other data security incident, our dedicated GDPR lawyers are here to help. We'll guide you through your rights, your legal options, and what compensation may be available to you.
Our Fees
We act for you on a no win, no fee basis. This means that, provided you meet your obligations and do not withdraw your instructions before your claim is concluded without our agreement, you will not be charged any fees, VAT, or outlays if your case is unsuccessful.
If Your Claim Is Successful
- Our fee will be deducted as a percentage of the compensation secured.
- This fee includes the cost of any After the Event (ATE) insurance arranged to protect you from liability for the other side’s costs if your claim is unsuccessful.
If You End Your Agreement Early
- If you withdraw your instructions or later continue your claim with another firm, you may be liable for the reasonable cost of the work completed and any outlays incurred up to that point.
- Other Circumstances Where You May Be Liable for Costs
- If you act fraudulently or provide misleading information.
- If you refuse our advice to settle after a formal offer is made.
Full Terms
Full details are set out in our Terms of Business, which will be sent to you when your claim is accepted. Making an initial enquiry does not place you under any obligation.
