Marks & Spencer has revealed that some personal customer data was stolen in the recent cyber attack, which could include telephone numbers, home addresses and dates of birth.
The High Street giant said the personal information taken could also include online order histories, but added the data theft did not include useable payment or card details, or any account passwords.
M&S was hit by the cyber attack three weeks ago and is struggling to get services back to normal, with online orders still suspended.
The retailer said customers would be prompted to reset account passwords "for extra peace of mind".
The ongoing problems are costing the retailer £43m a week in lost sales, according to analysis from Bank of America Global Research.
M&S chief executive Stuart Machin said the company was writing to customers to inform them that "unfortunately, some personal customer information has been taken".
"Importantly, there is no evidence that the information has been shared," he added.
However, it is understood that the hackers could yet share or sell on the stolen data as part of their attempts to extort M&S, which still represents a risk of identity fraud.
The retailer has not revealed how many of its customers have had their data stolen, but said it had emailed all website users to inform them, reported the case to the relevant authorities and was working with cyber security experts to monitor any developments.
According to its last full-year results, the company had some 9.4 million active online customers in the year to 30 March.
Mr Machin said M&S was "working around the clock to get things back to normal" as quickly as possible.
Marks and Spencer was not the only retailer to suffer a cyber incident of this nature.
The Co-op, which experienced a similar attack, is expected to resume online ordering services for its suppliers, on Wednesday.
Media reports, first cited in The Grocer magazine, say the retailer has told suppliers to prepare for some "volatility"..
