Marks & Spencer, the large British retailer, said on Tuesday that some customer data had been stolen in a cyberattack last month, an incident that has left the company unable to process online orders for weeks.

In an email to customers, M&S said that while some personal data, potentially including contact details and dates of birth, may have been accessed during the attack, there was no evidence that it had been shared. No card or payment details nor account passwords were compromised, the email said.

M&S, which reported more than 13 billion British pounds (roughly $17.2 billion) in annual revenue in the year ending in March 2024, reported the incident to government and law enforcement officials.