Marks and Spencer

Marks and Spencer (M&S) suffered a significant cyberattack on April 22, 2025, which compromised customer data including home addresses, phone numbers, and dates of birth. The attack is estimated to cost the company around £300 million in lost operating profit. The DragonForce hacking collective claimed responsibility, demanding payment for the attack. While no passwords or card details were stolen, the breach has raised concerns about data security.

Source: https://www.techradar.com/pro/security/mystery-of-m-and-s-hack-deepends-as-tcs-claims-none-of-its-systems-were-compromised

TPRM report: https://scoringcyber.rankiteo.com/company/marks-and-spencer

"id": "mar900062025",
"linkid": "marks-and-spencer",
"type": "Cyber Attack",
"date": "6/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'industry': 'Retail',
                        'name': 'Marks and Spencer',
                        'type': 'Retailer'}],
 'attack_vector': 'Compromised third-party supplier',
 'data_breach': {'data_exfiltration': 'Yes',
                 'personally_identifiable_information': 'Yes',
                 'sensitivity_of_data': 'Medium',
                 'type_of_data_compromised': ['Home addresses',
                                              'Phone numbers',
                                              'Dates of birth']},
 'date_detected': 'April 22, 2025',
 'description': 'Marks and Spencer (M&S) experienced a major cyberattack on '
                'April 22, 2025. The attackers compromised workers at Tata '
                'Consultancy Services (TCS), a third-party supplier, to gain '
                'access to M&S systems. The attack resulted in the theft of '
                'customer data, including home addresses, phone numbers, and '
                'dates of birth, but no passwords or payment details were '
                'compromised. The DragonForce hacking collective claimed '
                'responsibility and demanded a ransom. M&S forecasted a loss '
                'of around £300 million in operating profit.',
 'impact': {'data_compromised': ['Home addresses',
                                 'Phone numbers',
                                 'Dates of birth'],
            'financial_loss': '£300 million'},
 'initial_access_broker': {'entry_point': 'Third-party supplier'},
 'investigation_status': 'Ongoing',
 'motivation': 'Financial gain',
 'ransomware': {'data_exfiltration': 'Yes', 'ransom_demanded': 'Yes'},
 'references': [{'source': 'TechRadar Pro'}],
 'threat_actor': 'DragonForce hacking collective',
 'title': 'Marks and Spencer Cyberattack',
 'type': 'Cyberattack',
 'vulnerability_exploited': 'Human element'}