The Office of the Privacy Commissioner for Personal Data (PCPD) has confirmed to HKFP that Marks and Spencer (M&S) Hong Kong has not informed it of a recent customer data leak, nor responded to its enquiries.
In a notice to local customers this month, the British retailer said that “contact details – such as name, email address, addresses, telephone number – date of birth, online order history, ‘masked’ payment card details used for online purchases” may have been breached in a cyber heist last month.
There is no evidence that the data has been shared, and passwords and card or payment details were not stolen, it added.
M&S UK is reportedly being targeted by a ransomware gang that steals confidential data and scrambles it in the hope of extorting a ransom. According to the BBC, a loosely run group called Scattered Spider is using malicious software from a gang called DragonForce.
The PCPD – a statutory body which enforces the Personal Data Ordinance – told HKFP on April 30, on Wednesday last week, and again on Monday that M&S have been unresponsive.
The PCPD “has not received any data breach notification from the relevant organisation. The PCPD has commenced a compliance check on 30 April 2025 in accordance with established procedures and is yet to receive a response from the organisation,” the office said.
Those who log into the app have been greeted with an “under maintenance” notice for weeks.
It is unclear if customer data was stored locally by M&S, but the PCPD recommends that Hong Kong entities contact them following a breach.
Hong Kong stores are operated by Emirati conglomerate Al-Futtaim.
When asked about when the data breach occurred, when they became aware of the breach, and when customers were notified, Al-Futtaim did not respond on record on Monday.
Al-Futtaim were also unclear as to where local customer data was held, telling HKFP only that M&S Hong Kong’s database was separate to M&S UK’s systems: “At this time, there is no evidence to suggest that M&S Hong Kong’s database has been impacted by the incident reported in the UK.”
According to The Guardian, analysts at Barclays believe the incident could have cost the firm £200 million (HK$2.08 billion), though half could be recouped in an insurance payout.
Meanwhile, the attack has wiped £1.1bn (HK$11.46 billion) from M&S’ market value. The company’s annual results will be announced on Wednesday.
