The personal data of M&S customers has been stolen by hackers during a huge cyber attack that may have cost the company millions.
So what should those customers do now?
The retail giant admitted on Tuesday that some data had been stolen but reassured customers that no “usable payment or card details” were taken.
Read more: M&S says customers’ personal data taken by hackers
Passwords were also not included in the stolen data but there are reports that contact details like names, addresses and phone numbers were taken.
There is no evidence the data has been shared, M&S confirmed to Sky News on Wednesday.
Despite M&S saying customers “do not need to take any action” aside from changing their password next time they log in, cybersecurity experts are worried.
Co-op updates on recovery after cyberattack forced empty shelves
M&S says customers’ personal data taken by hackers
M&S ‘had no plan’ for cyber attacks, insider claims, with ‘staff left sleeping in the office amid paranoia and chaos’
Here’s what they want you to do if you have an M&S account.
Watch out for phishing scams
“We often see a spike in phishing emails, fake delivery texts and scam calls after breaches like this, particularly when order history or usernames are involved,” said Charlotte Wilson, head of enterprise at cybersecurity firm Check Point.
“This is not about panic, but it is a reminder that cybersecurity is not just about technology,” she said.
These scams can appear more convincing because hackers can include personal details like your name, address or phone number, stolen in attacks like the one on M&S.
“Some criminals may impersonate a well-known organisation and convince victims of their credibility by providing their name, address and date of birth – before using this false credibility to scam the victim out of their money,” said Sam Kirkman from NetSPI.
Please use Chrome browser for a more accessible video player
In fact, the criminal group reportedly behind the M&S attack is known to use tactics like this to scam people.
Rather than using software to hack past company firewalls, Scattered Spider hackers target human vulnerabilities and trick people into giving them access.
Read more from Sky News:
QR codes linked to online drugs
Could UK get US-style ‘supermax’ jails?
“Remember that we will never contact you and ask you to provide us with personal account information, like usernames, and we will never ask you to give us your password,” said M&S operations director Jayne Wall in a message to customers.
Be the first to get Breaking News
Install the Sky News app for free
Stop, challenge, protect
Mr Kirkman recommends following the “stop”, “challenge” and “protect” steps of Take Five, a national campaign aimed at protecting people from cybercrime:
Change passwords
M&S said no passwords were stolen in the data breach but Clare Loveridge from cybersecurity firm Arctic Wolf still says it is a “good idea” to change their passwords across all online accounts.
“Likewise, taking additional steps like activating two-step authentication will also improve protection, if it’s not been done already,” she said.
Follow our channel and never miss an update
This is because attackers may test reused passwords or login credentials stolen in previous data breaches.
“Stolen personal data can still be used as pieces of a puzzle by fraudsters,” said Tim Grieveson, from ThingsRecon.
