Overview

• By July 1, roughly half of M&S’s online operations, including web ordering to England, Scotland and Wales, have been reactivated.
• Click-and-collect, next-day delivery and orders to Northern Ireland remain suspended as the company completes its recovery.
• Investigators traced the breach to human error at an external contractor and linked it to the Scattered Spider hacking group.
• Stolen data included names, email addresses, postal addresses and dates of birth, but no payment or password information was accessed.
• M&S estimates the incident will cost about £300 million and is working with the National Cyber Security Centre to strengthen its systems.