Marks and Spencer plc

Companies / web services

Aliases / services: Marks & Spencer / M&S / マークスアンドスペンサー / Sparks / Marks and Spencer plc
Official website: https://www.marksandspencer.com/

Sources identifying the operating company

https://www.marksandspencer.com/help-and-support/my-account-and-m-and-s-policies

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

M&S.com customer accounts

Response status: Not listed
Response information checked: 2026-10-29

Current re-audit: Related incident verified; PHP connection not stated · Research date: 2026-10-29

In the 2025 incident, some customer data was taken, potentially including contacts, birth dates and online-order history. M&S says usable payment details and account passwords were excluded.

Scope: A PHP connection and response to the current PHP vulnerabilities are not listed.

What users should do

Do not give usernames or passwords to callers claiming to be M&S. Follow password-reset prompts when signing in through the official site or app.

Official service URL

https://www.marksandspencer.com/

Source URLs

2025 cyber incident: customer FAQshttps://corporate.marksandspencer.com/cyber-updateService and operation documentation

Related official sources

Operator and company informationOfficial information directoryIdentifies Marks and Spencer plc and the stated service scope.
2025 cyber incident: customer FAQsOfficial information directoryIn the 2025 incident, some customer data was taken, potentially including contacts, birth dates and online-order history.