M&S Hack Warning: Why Your “Low-Risk” Data Is Still a Big Risk

Almost every company would retreat into damage control and face-saving frenzy after a data breach, and Marks & Spencer was no different when it suffered what its CEO labelled a “sophisticated” cyber attack in April 2025.

The retailer has since issued multiple updates on containment efforts. The latest one came on May 13, when M&S confirmed that customer data had in fact been stolen but was quick to add that “the data does not include usable payment or card details, which we do not hold on our systems, and it does not include any account passwords.” Customers were told no action is needed, but will be prompted to reset passwords on their next visit or login as a precaution.

While we commend M&S for being upfront, the number of affected customers remains undisclosed. With about 9.4 million active online customers reported from last year, accepting the company’s reassuring and low-risk framing could be a costly mistake, and here’s why.

Table of Contents Table of Contents

1. Key Takeaways
2. Any Sensitive Data Can Be Dangerous in the Wrong Hands
3. Stay Cautious of Inference Attacks, Password Prompts
4. What the M&S Breach Tells Us About Corporate Responses to Cyber Attacks
5. What Impacted Customers Can Do to Stay Safe
6. The Bottom Line
7. FAQs
8. References

Show Full Guide

Table of Contents

1. Key Takeaways
2. Any Sensitive Data Can Be Dangerous in the Wrong Hands
3. Stay Cautious of Inference Attacks, Password Prompts
Show Full Guide
4. What the M&S Breach Tells Us About Corporate Responses to Cyber Attacks
5. What Impacted Customers Can Do to Stay Safe
6. The Bottom Line
7. FAQs
8. References

Any Sensitive Data Can Be Dangerous in the Wrong Hands

There’s a pattern that tends to repeat itself after a breach. A company confirms a cyberattack, admits some data was accessed, and then tries to calm the waters. In the case of M&S, the company stated that no payment details or account passwords were stolen, save for personal information. That was meant to reassure people. But what it actually does is reveal a bigger blind spot in how we think about cybersecurity risk.

Attackers don’t always need the crown jewels of customer data to cause serious harm. What’s often labeled as “non-usable” or “low-risk” data, like names, phone numbers, email addresses, and order history can still be incredibly valuable. It’s the kind of information that forms the foundation of phishing attacks and social engineering scams.

Cybersecurity Strategist at Sysdig, Crystal Morin, told Techoedia in a statement that attackers often find a way to use low-risk data to get to their targets. She said:

“Attackers will find a way to use the information they have, regardless of how insignificant it may seem. They can weaponize low-risk data by using victims’ personal information in targeted social engineering campaigns like spear-phishing emails, phone calls, multi-factor authentication request fatigue, and more.”

“This kind of data feeds directly into phishing attacks,” Ron Marsden, full-stack developer at Maxweb Solutions, shared with Techopedia in a chat.

Marsden said:

“If an attacker knows you’re an M&S customer and your name and email, they can send a very convincing fake email pretending to be from M&S, maybe asking you to reset your password or check a fake order.”

Marsden further explained that the goal isn’t always instant access to bank accounts, but often about building trust first, then exploiting it down the line.

Stay Cautious of Inference Attacks, Password Prompts

To set their customers at ease, M&S assured customers that they will be prompted to do a password reset when they try to log into their account. This is a good start, yet that’s where attackers may be looking to pounce.

While arguing the need for more proactive measures from the retailer, Mike Logan, CEO of C2 Data Technology, a data security posture management (DSPM) solutions developer and consultancy, warned that  “attackers can absolutely target victims through inference attacks.”

Although this method relies on logic and patience, Logan insists we should not “underestimate the creativity of modern hackers. They excel at piecing together small, seemingly harmless data points to reveal much more sensitive information.”

While spear phishing attacks on customers seem the most likely outcome from this type of incident, Martin Jartelius, CISO at Outpost24, noted that, depending on the data stolen, affected users should also expect more targeted marketing. He said:

“Depending on what information was in it, low-risk data can potentially also be used to identify your interest and allow targeted marketing towards you.”

What the M&S Breach Tells Us About Corporate Responses to Cyber Attacks

This breach exposed not just customer data but also just how thin many corporate responses to cyber attacks really are.

For a company with nearly 10 million online customers, the reaction followed a now-familiar rhythm: issue a statement, downplay the risk, and promise security improvements. This playbook is built more for PR than prevention.

Marsden said:

“‘Low-risk’ is a PR term. From a dev/security point of view, there’s no such thing. Any data loss is a risk.”

Marsden added that while M&S was transparent about the breach, its handling highlights a broader industry problem. “It looks like we’re still in reactive mode. M&S did the right thing by being upfront, but like a lot of organizations, it highlights that many companies still aren’t investing enough in proactive security,” he said.

Those proactive steps, experts argue, should go far beyond vague advice about changing passwords. Logan said the breach underscores the need for “data mapping and continuous risk assessments,” alongside stronger technical safeguards like zero trust architectures and strict access controls.”

When breaches happen, response efforts should do more than protect brand reputation. “Broadly speaking, this breach highlights that corporate responses often focus on reassuring the public and minimizing legal liability,” John Yensen, President at Revotech Networks, said in a statement to Techopedia.

“In my opinion, clear communication that comes with immediate support would be a very robust response,” said Yensen.

What Impacted Customers Can Do to Stay Safe

With data like emails, names, and perhaps phone numbers allegedly carted away, Marsden of Maxweb Solutions calls on M&S customers to “remain cautious” of password reset prompts, as attackers can use this data to create convincing phishing emails that mimic legitimate security alerts.

However, David Currie, CEO of Vaultree, a Secure Data Enablement Solutions, still calls on M&S customers to do a password reset before anything else.

Yensen recommends several steps to stay secure:

The Bottom Line

Despite the reassurance from M&S, a data breach of this magnitude should not be framed in a way that downplays its risks.

While the retailer has done their bit to contain damages, customers are enjoined to take it up from here now they’re aware that some of their data rests in the hands of cyber criminals. We can’t overemphasize the need to be vigilant at this time.

FAQs