**Marks and Spencer Confirms Customer Data Breach in Latest Cyber Attack Surge**
Marks and Spencer (M&S), one of the UK’s most recognisable retail groups, has fallen victim to a significant cyber attack, resulting in the unauthorised access of some customer information. While the company has assured the public that no payment or card details—and no account passwords—were compromised, the incident marks another worrying chapter in the intensifying battle against cyber crime targeting British businesses.
In a statement released via social media, M&S Chief Executive Stuart Machin downplayed the immediate risks to customers, emphasising that swift action had been taken to limit exposure. Machin explained that the breach was the result of a “sophisticated” assault, and urged customers not to panic or feel compelled to act immediately. However, as a precaution, all M&S account holders will be prompted to reset their passwords upon logging in next, with the company providing guidance on how to stay safe online.
The incident arrives amid a surge in cyber attacks across the UK, particularly those classified as “nationally significant.” According to Richard Horne, the Chief Executive of the National Cyber Security Centre (NCSC), the organisation has responded to 200 such incidents since September 2024—a striking increase compared to the previous year. Horne said twice as many attacks causing broad disruption had been recorded in the last eight months, and warned that digital aggressors are constantly scanning for vulnerabilities in both private and public sectors.
In a recent keynote at the CyberUK conference in Manchester, Horne offered a stark reminder of the dangers posed by well-financed, state-level cyber operations. “Adversaries are probing for weaknesses every day, operating in a space that blurs the line between peace and conflict,” he remarked. The conference heard warnings that nations such as Russia, China, North Korea, and Iran are all actively engaging in cyber espionage and attacks to further their geopolitical aims.
Horne specifically highlighted Moscow’s use of organised criminal groups to perpetrate disruptive cyber acts, aligning their operations with broader state goals. “There is a direct link between Russian cyber activity and threats to physical security,” he revealed, referencing concerns raised by the NCSC in partnership with the security service MI5. He also predicted that as ceasefire discussions over the Ukraine conflict progress, Russia will likely ramp up espionage efforts against Ukraine and those nations supporting its defence.
The repercussions of cyber breaches like that suffered by M&S are not limited to personal inconvenience or reputational harm. Horne stressed that such threats can endanger crucial services, national security, and even public safety. This sentiment was echoed by Cabinet Minister Pat McFadden, Chancellor of the Duchy of Lancaster, who described cyber threats as a “wake-up call” for the government and British business alike. McFadden candidly admitted that government IT systems are not “bombproof,” underscoring the pressing need to modernise legacy infrastructures.
To strengthen national cyber defences, McFadden unveiled a £16 million government package aimed at bolstering protection both domestically and abroad. The measures include investment in microprocessor memory protection technology, contributions to a new code of practice for software security, and financial support for both the UK’s Laboratory for AI Security Research and Ukrainian cyber defences. An additional £1 million has also been pledged to safeguard Moldovan elections from digital interference.
Beyond mitigation and response, there is a strong economic imperative for the UK to establish itself as a leader in cybersecurity. McFadden told conference attendees that the sector already supports more than 2,000 British businesses, and has the potential to become a vital driver of jobs, innovation, and international influence.
As the digital landscape evolves and cyber threats grow increasingly complex, the breach at Marks and Spencer serves as a timely reminder of the critical importance of robust cyber hygiene for businesses and individuals. Customers are encouraged to remain vigilant, follow recommended online security measures, and watch for future updates as authorities and companies continue their efforts to shore up defences against the ever-changing threat landscape.