TL;DR: In April 2025 Marks & Spencer and the Co-op were hit by related cyber attacks. M&S said customer names, dates of birth, phone numbers, home and email addresses and online order histories could be affected, but no usable card details or passwords. The Co-op's chief executive later confirmed the names, addresses and contact details of all 6.5 million members were taken, with no financial data. The main risk now is convincing phishing that uses those real details.

👉 Free check covers your email in 30 seconds — full scan adds your phone number →

What happened at M&S

M&S detected the intrusion on 22 April 2025 and paused online orders. In May it confirmed customer data had been taken. According to The Register's report, the data that could be affected included:

M&S said the data did not include usable payment or card details, or account passwords. Customers were prompted to reset their password at next login. Reports linked the attack to the group known as Scattered Spider, though no group formally claimed it. The attack reportedly cost M&S around £300 million in lost earnings, City AM reported.

What happened at the Co-op

The Co-op shut down parts of its IT systems on 30 April 2025 after spotting the attack. In July 2025, chief executive Shirine Khoury-Haq confirmed that the personal data of all 6.5 million members had been taken. She said, as quoted by City AM: “There was no financial or transactional data taken, but names, addresses and contact information was accessed.” The National Crime Agency arrested four people, three of them teenagers.

How to tell if you were affected

Why it still matters

No card numbers were taken, so why worry? Because a name, date of birth, address, phone and recent orders are exactly what make a scam believable. Expect texts and calls that mention a real order, a “refund,” or a fake M&S or Co-op security team. Our UK identity theft statistics show how often stolen identity details turn into fraud.

What to do now

  1. Treat contact “about the breach” as suspicious. Neither company needs your card details or a one-time code over the phone.
  2. Change any reused password and turn on two-factor authentication where you can. See what to do when a password leaks.
  3. Forward scam texts to 7726 and report phishing emails to report@phishing.gov.uk.
  4. Cut down future calls by registering with the Telephone Preference Service.
  5. Ask what they hold. You can make a subject access request to either company.

Retail breaches stack up. A free email exposure check shows every known breach your email appears in, and the full Scan My Shadow scan adds your phone number.

Frequently Asked Questions

Was my data stolen in the M&S cyber attack?

M&S said customer names, dates of birth, phone numbers, home and email addresses, household information and online order histories could be affected. Usable card details and passwords were not included.

What data was stolen from the Co-op?

The Co-op’s chief executive confirmed the names, addresses and contact details of all 6.5 million members were taken. She said no financial or transactional data was taken.

When did the M&S and Co-op attacks happen?

April 2025. M&S detected its intrusion on 22 April and the Co-op shut down parts of its IT systems on 30 April.

Do I need to cancel my card after the M&S breach?

M&S said no usable card details were taken. Watch statements anyway and never give card details to anyone who contacts you about the breach.

What scams follow a retail data breach?

Texts, emails and calls using your real name and order details to push fake refunds, delivery problems or security checks. Verify through the official app or website.

Sources

Related Reading