Marks & Spencer Confirms Personal Customer Data Stolen in Ransomware Attack

Strategic Insights -

Marks & Spencer has finally admitted that some personal customer information was taken in the cyber-attack that has crippled its online operation for over three weeks. The retailer's IT systems were hit by a ransomware attack in late April, forcing it to shut down its online ordering system and take some of its systems offline. The company has assured customers that the stolen data does not include usable payment or card details and does not include any account passwords. Despite this, Marks & Spencer has advised customers to reset their passwords for extra peace of mind.

Key Takeaways:

  • Marks & Spencer has confirmed that some personal customer information was taken in the cyber-attack, but the data does not include usable payment or card details or account passwords.
  • The retailer has not revealed how many customers have been affected by the data breach.
  • Marks & Spencer has taken steps to protect its systems and engaged leading cybersecurity experts to resolve the issues caused by the attack.
  • The company has reported the incident to relevant government authorities and law enforcement agencies.
  • The Information Commissioner's Office (ICO) is working closely with the National Cyber Security Centre to investigate the incident.
  • Customers who are concerned about their personal information can visit the ICO website, which offers advice on what to do in the event of a cyber-attack.

Statistics:

  • The cyber-attack has been ongoing for over three weeks, with Marks & Spencer's online ordering system disabled since 25 April.
  • The company has reported the incident to relevant government authorities and law enforcement agencies.
  • The Information Commissioner's Office received reports from Marks & Spencer and the Co-op Group on 2 May.
  • The ICO is working closely with the National Cyber Security Centre to investigate the incident.

Sources:

  • Marks & Spencer, "Statement regarding cyber-attack"
  • Information Commissioner's Office, " ICO investigates M&S cyber-attck"
  • ICO, "What to do if you've experienced a cyber-attack"