The ongoing problems are costing the retailer £43m a week in lost sales, according to analysis from Bank of America Global Research.
M&S chief executive Stuart Machin said the company was writing to customers to inform them that “unfortunately, some personal customer information has been taken”.
“Importantly, there is no evidence that the information has been shared,” he added.
However, it is understood that the hackers could yet share or sell on the stolen data as part of their attempts to extort M&S, which still represents a risk of identity fraud.
The retailer has not revealed how many of its customers have had their data stolen, but said it had emailed all website users to inform them, reported the case to the relevant authorities and was working with cyber security experts to monitor any developments.
According to its last full-year results, the company had some 9.4 million active online customers in the year to 30 March.
Mr Machin said M&S was “working around the clock to get things back to normal” as quickly as possible.
Marks and Spencer was not the only retailer to suffer a cyber incident of this nature.
The Co-op, which experienced a similar attack, is expected to resume online ordering services for its suppliers, on Wednesday.
Media reports, first cited in The Grocer magazine, say the retailer has told suppliers to prepare for some “volatility”., external.
