Cyber attacks see two thirds of UK consumers changing online shopping habits

The recent spate of cyber attacks on retailers including M&S, Co-op and Harrods is seeing UK consumers changing their online shopping habits, with 66% now rethinking how and where they shop online.

That’s according to new data from global research and insights agency, Opinium, which conducted an online survey of 2,000 UK Adults aged 18+, between 23-27 May 2025.

It revealed that almost a quarter of consumers (23%) now intend to only shop online with brands they completely trust, while 22% will only shop with brands they feel have strong security.

The cyber chaos has deeply shaken consumer confidence and over half (55%) of consumers now fear their personal data has already been compromised in a breach.

Additionally, 15% now expect to shop online less frequently and 9% are avoiding online shopping temporarily. Meanwhile, others are taking action to protect themselves, with one in five (19%) changing their passwords before shopping again, and 12% deleting old accounts with online retailers.

When it comes to who has most responsibility for protecting shoppers online, 33% think that this sits with retailers, with a similar number (32%) believing cyber security or IT providers are mainly accountable. Others put responsibility with the government (13%) and the police (5%), while 4% think shoppers themselves bear most accountability.

Opinium’s data highlights how consumers are increasingly wary of cyber attacks and their potential impact. Nearly three-quarters (73%) now see cyberattacks as one of the biggest risks facing UK consumers, with 82% saying companies must do more to protect their data, and 78% believe they should be more transparent about how they protect personal data.

James Endersby, CEO at Opinium, said: "The recent wave of cyber attacks on retailers has highlighted vulnerabilities within the sector. As a result, shoppers are now more reluctant to spend money online and this may impact businesses.

"Retailers therefore need to prioritise this by investing in cyber protection and clearly communicating to customers that they’re in safe hands. Otherwise, they may run the risk of losing out on custom now and in the future."

Problems started for M&S over the Easter holiday weekend, with shoppers reporting they were unable to use contactless payments or click and collect services. Then, on 13 May, the retailer confirmed that personal customer data had been stolen as part of the cyber attack.

However, M&S stressed the data did not include payment or card details, or account passwords, and was not believed to have been shared online.

On 30 April, Co-op also fell victim to a cyber attack and is continuing to deal with the fall out. That was swiftly followed by a cyber attack attempt on Harrods on 1 May, however the department store’s IT security team "immediately took proactive steps to keep systems safe".

In the wake of the cyber attacks, on 7 May the Government revealed plans to increase cyber security. Chancellor of the Duchy of Lancaster, Pat McFadden, told tech experts and business chiefs that cyber security is "not a luxury but an absolute necessity", as he announced a £16 million package to boost defence at home and abroad.