Tech expert reveals five urgent actions M&S shoppers must take after major data breach

Marc Porcar, CEO of QR Code Generator, told victims caught in the cyber nightmare they need to move quickly to block criminals who now hold their private information and could raid accounts or set up loans using stolen details.

"The M&S data hack puts thousands of customers at risk of having their personal information used by criminals," Porcar said. "Fast action by affected shoppers will help reduce the chances of suffering further harm."

The significant security failure exposed names, emails, phone numbers and some payment card details of M&S shoppers. The retail giant has contacted victims, but security pros warn that just following company advice leaves shoppers open to attacks from cyber gangs who know exactly how to use the stolen details.

Ways cyber criminals can use M&S shoppers’ data

Names, email addresses and phone numbers may seem like small things on their own, but fraudsters can use these to complete profiles on you that they then use to apply for loans, credit cards and even buy houses using your stolen identity.

“With your personal contact information, criminals can attempt to access your other online accounts. They can use your email and phone number to easily track you down and target you with phishing attacks,” Porcar said.

Porcar revealed five urgent steps every M&S shopper hit by the breach should take straight away:

Check bank accounts daily for unusual activity

While M&S have confirmed that no payment or card details have been stolen, nor any account passwords, it is a good idea for customers to check their bank accounts regularly anyway. "Monthly statements come too late," Porcar warned. "Look at your accounts every day for strange purchases, even tiny ones for just pennies. Thieves test cards with small amounts first before they steal everything once they know which cards work."

Change all passwords

"Many people use the same password everywhere, which makes hackers very happy," said Porcar. "If your details were stolen in this attack, you need new passwords for everything, especially banking and emails. Each account needs its own complex password nobody could ever guess."

Turn on two-factor authentication

"This extra security works like a second lock criminals cannot break even with your password," Porcar said.

Examples of two-factor authentication include using a password plus a code sent via a text message, a password combined with a time-based code from an authenticator app or a PIN followed by fingerprint or facial recognition.

"Those few seconds needed to approve a login on your phone will save thousands of pounds and many hours fixing identity theft or fighting charges that could empty your account without warning."

Watch for fake emails

"These criminals make messages that look exactly like ones from M&S or your bank with perfect logos and writing," Porcar warned. "They will mention the breach to make you think the email is real, then trick you into 'confirming details' through links that steal more information or install software that records everything you type, including all your passwords and card numbers."

Always contact your bank or M&S using official methods, like phone numbers you've checked and confirmed yourself.

Use credit monitoring

"These services work like alarm systems that tell you straight away when someone tries using your name for loans or credit cards," said Porcar. "Many give free trials so you can get protected without paying, giving peace of mind during those vital weeks after your information leaks when criminals try to use your freshly stolen details."

Credit https://qrfy.com/

Sources:

• Cyber Security Breaches Survey 2025: gov.uk/government/statistics/cyber-security-breaches-survey-2025/cyber-security-breaches-survey-2025
• Information Commissioner's Office: ico.org.uk/action-weve-taken/complaints-and-concerns-data-sets/data-security-incident-trends/