Hackers went undetected in Marks and Spencer's systems for up to 52 hours before the alarm was raised in what insiders are describing as a 'colossal mistake'.
Believed to have been from the Scattered Spider group, the attackers got into the retailer's IT systems via a contractor.
The hackers were then able to work undetected in the systems for just over two days before finally being uncovered, a source said.
Once discovered, emergency response teams battled tirelessly to protect the beloved British store, frequented by up to 9.4million active customers, throughout a five-day 'attack phase'.
'What went wrong was human error. Human error is a polite word for somebody making a colossal mistake,' a source told The Times.
