Lawyers claim more than 1,000 people to join legal action against Marks and Spencer after customer data breach

This comes after a catastrophic data breach in April that saw personal details belonging to millions of customers stolen by cyber criminals.

The action, led by Thompsons Solicitors Scotland, allows affected individuals to seek compensation collectively, rather than through individual claims.

Currently, more than 1,000 Scots have joined legal action against the retailer according to lawyers.

The law firm told The Scotsman that this is now the “fastest growing case” that they have ever handled.

They added that the public are “furious” with M&S who they saw as a “trusted brand”.

What happened during the M&S cyber attack?

Marks and Spencer experienced a cyberattack over the Easter break. The online attack resulted in sensitive system files which included customer credentials being stolen.

The incident affected contactless payments and click-and-collect orders in stores across the UK. There was also another problem that affected only contactless payments.

M&S has since admitted that the incident was the result of “human error” and said the fallout is expected to cost the company around £300m.

‘Fastest case’ law firm have ever handled

In a statement to The Scotsman, Patrick McGuire, senior partner with Thompsons Scotland, said: “The level of engagement from the public with this class action has been huge. It is the fastest growing case we have ever handled.

“The public are furious with M&S who they saw as a trusted brand while the hackers saw them as an easy target.

“The failure to protect our clients valuable data has led to many already being targeted by organised criminals.

“I expect this case to continue to grow and we will make sure our clients get proper compensation for this huge breach of trust.”

An M&S spokesperson said they had not yet received any group litigation claims.

The company also notified regulators soon after discovering the cyber incident and said it continued to work closely with them.

A spokesperson said: “We wrote to our customers as soon as we could in relation to their personal data, making clear that no useable card or payment details or account passwords had been extracted during the cyber incident, and that there was no evidence that any customer data had been shared, which we continue to monitor and remains the case.”