Marks and Spencer Group PLC (LSE:MKS) has confirmed that some personal customer data was compromised during the cyber-attack that has disrupted its online operations for over three weeks.
While payment details and account passwords were not accessed, names, addresses, and order histories were taken, according to the Guardian.
The company said there is no evidence that the stolen data has been shared and reassured customers that payment information is not stored on its systems.
For added security, customers will be prompted to reset their passwords when next logging in.
M&S’s website and app have been offline since 25 April following a ransomware attack linked to the group known as Scattered Spider.
The company has brought in cybersecurity specialists and reported the incident to authorities.
The Information Commissioner’s Office confirmed it is investigating and is working alongside the National Cyber Security Centre to assess the breach and protect affected customers.
Marks' shares, down 11% in the past month, were up 1.4% at 350.45p in early trading.