An Indian company operating Marks & Spencer's IT helpdesk is investigating if it was used as a gateway for cybercriminals to access the retailer's systems.
M&S confirmed that hackers used 'social engineering' techniques to gain access, with potential costs of up to £300m in profit.
Tata Consulting Services (TCS), a contractor for M&S, is conducting an internal inquiry to determine if its employees or systems were linked to the cyber-attack.
The Information Commissioner's Office (ICO) may impose fines for any loss of customer and staff data, as M&S faces disruptions in operations with its website not expected to be fully functional until July.