M&S is facing an “unprecedented” class action lawsuit from Scottish law firm Thompsons Solicitors as a result of the cyber attack which affected their operations more than a month ago.
Scottish customers who had their data stolen as part of a cyber attack that caused widespread disruption across the retailer’s operations are being encouraged to join the claim.
Last month M&S admitted to customers their personal information may have been stolen as a result of the cyberattack.
In a statement at the time, the retailer said: “Unfortunately the nature of the incident means some personal customer data has been taken.
“Importantly, there is no evidence that this data has been shared and it does not include useable card or payment details, or account passwords, so there is no need for customers to take any action.”
Customers were prompted to reset their password though the store assured customers this was only for “extra peace of mind.”
The theft of customer data, while not an immediate concern on its own, does open up customers to a greater risk of fraud and scams with people either posing as M&S or using the stolen data to feign knowledge of the customer.
Thompsons Solicitors says customers joining the legal claim could be entitled to compensation for this increased risk as well as financial losses (now or in the future), distress, anxiety, and time spent resolving issues or securing accounts.
Speaking to ITV News, senior partner Patrick Mcguire, said: “The clients who have joined our class action against Marks and Spencers have done so because their valuable confidential personal details were stolen.
“It was the responsibility of M&S to protect that information and they failed completely to do so. They have breached data regulations and caused distress to our clients a significant number of whom have already been the victims of attempted scams.”
Thompsons Solicitors say more than 350 people have joined the class action so far, adding the level of response has been “unprecedented” for a case of its type in Scotland.
In response, M&S told ITV News: “We communicated to our customers as soon as we could and told them that the data taken does not include any useable card or payment details, or account passwords. M&S does not hold full card details on its systems.”
M&S say they “have not received any claims.”
M&S is still struggling to restore full operations after a cyber attack left them unable to take contactless payments, handle click and collect orders, keep shelves stocked and take online orders.
Last month the retailer admitted the attack could cost as much as £300m, with these latest legal troubles only adding to the company’s difficulties.
Speaking to ITV News, retail and PR expert Rhea Freeman, said regardless of this claim’s outcome, “any time a brand is involved in a lawsuit they’re receiving publicity for the wrong reasons.”
Despite this, she believes the long-term damage to M&S’ brand will be minimal.
“I think the way that M&S dealt with the issue from a PR perspective – keeping customers informed, messages from the CEO, explaining the steps they were taking, and being fully transparent, means that the brand damage will be less.
“The issue that’s being raised with the lawsuit has been well documented – so there’s no shock factor.
“Many people feel sorry for M&S and their team as they have worked so hard and tried to balance issues with customer care and satisfaction, so whilst this definitely isn’t good for the brand, I think it could have been a lot worse from a brand image point of view.”
Outside of any potential lawsuits, Rhea says how M&S continues to “nurture the customers they have,” keeping them informed and “acknowledging the inconvenience,” will go a long way to mitigating potential damage to the brand.
Follow STV News on WhatsApp
Scan the QR code on your mobile device for all the latest news from around the country
