Marks & Spencer (M&S) is facing a multi-million pound court action by Scottish customers after a cyber attack.
The high street giant admitted last week that hackers have obtained information which could include the telephone numbers, home addresses, dates of birth, and online ordering histories of millions of people, reports the Daily Record.
Thompson's Solicitors, the firm representing the affected customers, claim they have been "inundated" by M&S clients caught up in this "online heist."
READ MORE: Disco diva stuns fans with surprise appearance at huge Hydro gig
Senior partner Patrick McGuire said: "M&S pride themselves on their customer service and reliability, but in this most important area, they have failed their customers completely.
"We have a situation here where one of the most famous retailers in the UK has allowed criminals to pillage the personal details of hundreds of thousands of Scottish customers."
"I think this will be the biggest data theft case we have ever been involved in."
More than £1.2 billion has been wiped off the market value of M&S since it was crippled by hackers three weeks ago.
The company is still not taking online orders, has been left with empty shelves at some branches, and is reported to be losing up to £3.5 million a day.
M&S’s Sparks loyalty program had 18 million members, with hundreds of thousands in Scotland, and the firm has asked customers to reset their account passwords.
The retailer has also warned customers that they might receive bogus emails, calls or texts claiming to be from the company.
READ MORE: 'Pandemic hit youngest and poorest children hardest', says Glasgow's education boss
According to the Daily Record, a group of hackers labelled Scattered Spider is alleged to have utilised a contractor to access the retailer’s advanced IT systems.
The ransomware group DragonForce, which is also believed to be behind a cyber attack on the Co-op, have said its affiliates are responsible.
The group is known for scrambling victims’ data and demanding a ransom to get the key to unscramble it.
The UK Government’s National Cyber Security Centre has said it was working with the affected companies but told all UK businesses the incidents "should act as a wake-up call" on the importance of having measures to protect against and respond to attacks.
However, McGuire of Thompsons, who are already pursuing legal actions against other businesses who have lost customers’ personal data said: "The law in this matter is very clear and it beggars belief that an institution like M&S did not have the robust systems that law demands to prevent the real risk of identity theft and fraud.
"We know well from our experience that the type of information taken from M&S customers can be used in very sophisticated scams by international criminals."
READ MORE: Over 40 road closures in Glasgow today as Race for Life takes place
The hack first caused problems for the retailer’s contactless payments and click-and-collect orders.
A spokeswoman for the company told the Daily Record: "Importantly, the data does not include usable payment or card details, which we do not hold on our systems, and it does not include any account passwords.
"There is no evidence that this data has been shared."
Clive Black, a retail analyst at finance firm Shore Capital, said: "What is clear to us is that this has a severe impact on first-quarter performance - hundreds of millions of pounds - and by definition a notable impact for the full year outcome for 2026."
Share