Marks & Spencer, the iconic U.K. clothing and food retailer that’s seen its online operation shuttered for more than three weeks following a cyberattack, on Tuesday said for the first time that customer data was taken.

A cyber attack at the Co-op forced the chain to take measures that led to gaps on shelves. But insiders say the company is close to resorting the issues for shoppers

The U.K. retailer on Tuesday said the data didn’t include useable payment, card details or account passwords.