Marks & Spencer (M&S) is bracing for potential claims that could amount to hundreds of millions of pounds following a significant cyberattack that compromised customer data. The retailer has revealed that hackers infiltrated its systems over the past three weeks, gaining access to sensitive information such as contact details, dates of birth, and online order history. Importantly, M&S clarified that no payment or card details were stolen and reported no evidence of data being shared. However, the company has advised customers to remain vigilant against possible phishing attempts via emails, calls, or texts masquerading as official communications from M&S.
Legal experts are now suggesting that M&S may face numerous compensation claims, leveraging a growing trend in consumer protection. Luke Harrison, a partner at Keidan Harrison, pointed out that customers could seek compensation even in the absence of tangible financial loss. Individuals may claim damages equivalent to the "notional price" they would demand for their data's unauthorised use. He emphasised the potential for class action lawsuits to emerge, citing the efficiency of firms that utilise social media to attract claimants.
“The clients are passengers while the law firm runs the claim,” Harrison explained, indicating that law firms could negotiate settlements on behalf of their clients. This kind of litigation has precedent, as demonstrated by the case of British Airways (BA), where 16,000 claimants successfully won a class action following a major data breach in 2018—an incident that involved significant personal information and resulted in a confidential settlement in 2021. The model for claiming compensation is set to be similarly high for M&S, particularly with an active membership base of 18 million for its loyalty app.
Melanie Hart from Kingsley Napley noted that the concept of "loss of control damages" could play a pivotal role in these claims, underscoring the anxiety generated by data breaches even if participants did not suffer direct financial losses. Harrison suggested that M&S may prefer to offer voluntary compensation to evade a protracted legal battle, a common tactic employed by companies facing such allegations.
Cybersecurity experts are also on high alert regarding the fallout from this breach. Charlotte Wilson, head of enterprise at Check Point Software, has stated that the nature of the stolen data increases the risk of targeted phishing attacks. Based on historical trends, companies often observe spikes in such scams following data breaches where personal histories, including usernames, are compromised.
M&S has taken steps to mitigate further damage. In its statement, the retailer confirmed that it has reported the incident to relevant authorities, including law enforcement, in cooperation to investigate the breach thoroughly. Legal analysts, however, have raised concerns about the scrutiny M&S will face regarding its security protocols. Benjamin Ross, global head of privacy at Bortstein Legal Group, pointed out that the Information Commissioner’s Office (ICO) could impose fines if it finds M&S at fault, with potential penalties capped at 2% of the company's annual turnover, which could translate to around £260 million.
Interestingly, M&S is not alone in this predicament; shortly after its announcement, the Co-op Group also disclosed that customer data had been compromised in a separate breach. Retailers are now under increased pressure to fortify their cybersecurity measures, as data breaches not only threaten customer trust but also open the door for extensive legal repercussions. The evolving landscape of data protection laws, particularly under the UK's General Data Protection Regulation (UK GDPR), reinforces the obligation of companies to protect personal data and respond adequately to breaches.
As the legal implications of M&S’s data breach continue to unfold, affected customers and legal experts alike will be closely monitoring how the situation evolves, particularly in light of the historical context and potential for similar claims to emerge across the sector.
Reference Map
- Paragraphs 1, 2, 3, 4, 5, 6
- Paragraph 2
- Paragraph 4
- Paragraph 5
- Not referenced
- Not referenced
- Not referenced
Source: Noah Wire Services