The Metropolitan Police's Cyber Crime Unit and the National Crime Agency are investigating the incident.
M&S has temporarily taken some systems offline, leading to limited product availability in some stores.
The attack initially affected contactless payments and click-and-collect orders, and the company's website and app remain down.
Experts suggest the recovery process could take several days due to the need for thorough checks to ensure the attackers are completely removed from the system.