A law firm promising M&S customers compensation over a data breach says it has signed up more than 300 claimants, a week after going public with the action.
Thompsons Solicitors Scotland last week made it easy for M&S customers to join the claim by filling in a form on the law firm’s website.
“If you’ve received an email or notification from M&S about this breach, or if you’re concerned your personal information may have been compromised, you may be entitled to compensation,” the site says, with a button to ‘start your claim’.
Thompsons senior partner Patrick McGuire told The Grocer: “We currently have just over 300 participants in the lawsuit and we expect that to increase substantially in the coming weeks and months. In my experience, this is an unprecedented engagement with a class action.”
Another firm has been gathering claims on social media over the breach of M&S customer data in a cyberattack.
A post on Facebook by Join the Claim says: “If you’ve ever shopped online with M&S, held a loyalty account, or used their app – use our free checker to see if you might qualify.”
A form on Join the Claim’s website asks if respondents are M&S customers, Sparks members or employees, if they received notification of the breach from the retailer and if they have a screenshot of that notification. Answering yes to the questions leads to the response: “Good news! Based on your answers, you could qualify to join a claim. Register your interest and we’ll notify you if we find a regulated law firm to handle your case – all on a no-win, no-fee basis.”
Read more: Lawyers eyeing M&S cyberattack slammed by campaign against ‘predatory litigation’
Join the Claim describes itself as “a platform that helps individuals and businesses join group legal actions to seek compensation for damages caused by large corporations or other entities”. “We’re not a law firm, instead we safely and securely connect individuals with expert law firms,” the site says.
A Join the Claim spokesperson said: “Since news of the M&S breach emerged, we’ve seen a significant level of concern from customers – prompting us to launch a campaign to assess eligibility for potential legal action against the retailer.
“The response has been strong, and we’re in active discussions with several law firms who are looking to pursue claims on behalf of those affected.”
It comes after The Grocer revealed warnings from legal experts that the M&S customer data breach would be leapt on by class action software companies working with law firms to build a book of clients using social media.
M&S told customers on 13 May that personal data including date of birth, ‘household information’, telephone numbers and ‘masked’ payment card details had been taken by hackers. It said the data accessed did not include useable payment card details and there was no evidence information had been shared by the hackers. The admission, which came three weeks after M&S first told customers of the ‘cyber incident’, also said they would need to reset their password to log in to M&S’s website or app.
Thompsons claims M&S customers could be eligible for compensation for distress or anxiety, time spent resolving issues or securing accounts, and increased risk of fraud or identify theft.
Read more: How far has the cyberattack knocked M&S off course?
Lawyers have estimated the claim could be around £500 per individual. “If you have 250,000 claims of £500 each, it obviously adds up to a very significant sum,” said Luke Harrison, partner at law firm Keidan Harrison.
M&S last week said that online clothing and home deliveries would remain disrupted until July as a result of the cyberattack, and forecast a £300m hit to annual profits as a result.
The retailer said it had not received any claims over the customer data breach.
AJ Bell investment analyst Dan Coatsworth warned of possible additional costs arising from the breach. “There’s still a big unknown regarding any potential fines on Marks & Spencer from the Information Commissioner’s Office, which enforces data protection regulation,” Coatsworth said.
“Tesco Bank was fined £16.4m by the FCA for failing to exercise due skill, care and diligence in protecting customers against a cyberattack in 2016.”
Kantar’s monthly market update today revealed M&S grocery sales growth remained strong despite the episode, rising 12.3% year on year in the 12 weeks to 18 May 2025.
“Today’s Kantar report shows how resilient our business is and I want to say thank you to our customers for choosing M&S,” said M&S Food MD Alex Freudmann.
4 Readers' comments