Getty ImagesMarks & Spencer has revealed that some personal customer data has been stolen in the recent cyber attack, which could include contact details and date of births.
The High Street giant said the personal information taken could also include online order histories, but added the data theft did not include useable payment or card details, or any account passwords.
M&S was hit by the cyber attack some three weeks ago and is still struggling to get services back to normal, with online orders still suspended.
The retailer said customers would be prompted to reset passwords for accounts "for extra peace of mind".
M&S chief executive Stuart Machin said the company was writing to customers on Tuesday to inform them that "unfortunately, some personal customer information has been taken".
"Importantly, there is no evidence that the information has been shared," he added.
M&S confirmed the contact information stolen could include:
The retailer added any card information taken would not be useable as it does not hold full card payment details on its systems.
In an email to customers, M&S operations director Jayne Wall said: "You do not need to take any action, but you might receive emails, calls or texts claiming to be from M&S when they are not, so do be cautious.
"Remember that we will never contact you and ask you to provide us with personal account information, like usernames, and we will never ask you to give us your password."
Mr Machin said M&S was "working around the clock to get things back to normal" as quickly as possible.
M&S began experiencing problems with its systems on 25 April, when there were issues with in-store payments before they spread to other parts of the organisation.
20 PerFlyer
