300 people join M&S lawsuit after data lost

Marks & Spencer expects that cyberattack to hit annual profits by around £300 million.
Marks & Spencer expects the cyberattack to hit annual profits by around £300 million. (Marks & Spencer)

More than 300 people are taking part in a class action lawsuit against Marks & Spencer after their data was lost in a cyberattack over the Easter weekend.

The suit was launched by Thompsons Solicitors Scotland earlier this month with the goal of securing compensation for people whose data was stolen during attack.

Patrick McGuire, senior partner at Thompsons Solicitors Scotland, explained that the firm expects many more people to join the lawsuit in the coming weeks.

“Since the launch of our class action against Marks & Spencer we have been contacted by many more additional Scottish victims of the data theft,” McGuire said.

“We currently have just over 300 participants in the law suit and we expect that to increase substantially in the coming weeks and months. In my experience this is an unprecedented engagement with a class action.”

The lawsuit is signposted on the Thompsons Solicitors Scotland encouraging anyone that has been impacted by the attack, which is being linked to a hacking group called Scattered Spider, to participate.

McGuire has argued that Marks & Spencer should have had better systems in place to protect the data of their customers, many of whom he said were already being contacted by scammers.

“Data theft is a serious crime and Marks & Spencer inability to protect their loyal customers is completely unacceptable and my team will ensure they receive proper compensation,” he added.

“The law in this matter is very clear and it beggars belief that an institution like M&S did not have the robust systems that law demands to prevent the real risk of identity theft and fraud. We know well from our experience that the type of information taken from M&S customers can be used in very sophisticated scams by international criminals.”

McGuire concluded by saying that this will be the “biggest data theft case” that the firm has ever been involved in.

“We have been inundated by Scots M&S clients who have been caught up in this online heist and are contacting Thompsons given our experience in this area,” he concluded.

According to the M&S, its online services will continue to be disrupted until July as a result, while the impacts of the attack will hit annual profits by around £300 million.

In the year to 29 March 2025, just prior to the attack, M&S reported profits before tax of £875.5 million.


Also read → Iceland recalls product due to allergen error