Law firm files class action lawsuit against M&S following data breach
Thompsons Solicitors said it has received an ‘avalanche’ of enquiries following Marks and Spencer’s confirmation that customer data had been stolen through the attack
A Scottish law firm has launched a class action legal case against Marks and Spencer after customers’ personal data was stolen following a major cyber attack. Thompsons Solicitors said it has received an “avalanche” of enquiries following Marks and Spencer’s confirmation that customer data had been stolen through the attack.
In a recent update, the retailer said the data does not include usable payment or card details, which are not held on its systems, and does not include any account passwords. It added there was “no evidence that this data has been shared”.
Marks and Spencer added that customers do not need to take any action, and will be prompted to reset their password the next time they visit or log onto their M&S account “for extra peace of mind”. It will also share information with customers on how to stay safe online.
Patrick McGuire, a senior partner at Thompsons, said the theft of personal data was a “serious matter and that M&S had failed in their responsibility to protect customers”.
In a statement, he said: “We have a situation here where one of the most famous retailers in the UK have allowed criminals to pillage the personal details of hundreds of thousands of Scottish customers.
“The law in this matter is very clear and it beggars belief that an institution like M&S did not have the robust systems that law demands to prevent the real risk of identity theft and fraud. We know well from our experience that the type of information taken from M&S customers can be used in very sophisticated scams by international criminals.
“M&S pride themselves on their customer service and reliability but in this most important area they have failed their customers completely. We have been inundated by Scots M+S clients who have been caught up in this online heist and are contacting Thompsons given our experience in this area.”
He added: “I think this will be the biggest data theft case we have ever been involved in. Group litigation also known as Class Actions means that the public can hold Marks and Spencers to account for the theft of their details. It’s legal action of this kind that gives consumers redress and shows retailers that they cannot skimp on cyber security.”
An M&S spokesperson told Retail Sector: “Importantly, the data does not include usable payment or card details, which we do not hold on our systems, and it does not include any account passwords. There is no evidence that this data has been shared.
“Our stores have remained open, and availability is now in a much more normal place with stores well stocked this week.”
