The incident at Victoria’s Secret comes after a number of major UK retailers have been hit by major cyber attacks.
M&S says it expects the hack it has been affected by will cost it around £300m, with disruption continuing until July.
The Co-op experienced empty shelves and disrupted payments after it was hacked.
Customer data has been stolen from both firms.
The cyber criminals who say they were responsible told the BBC that they targeted the firms with ransomware, which involves scrambling IT systems and telling companies they will only be restored in exchange for payment.
The police told BBC News that the crime gang Scattered Spider – some of whom are thought to be teenagers – are among the suspects.
Vonny Gamot, from online protection company McAfee, recommended any affected customers should take immediate action such as changing passwords and enabling two-factor authentication on accounts that support it.
She also said people should not wait to find out if they had been directly caught up in the cyber attacks.
“Even if you haven’t received notification from the brand or retailer which has been impacted, assume your information may have been compromised if you’ve been a customer,” she said.
“Companies often take weeks to identify all affected individuals.”
