It is and you are right to treat any unsolicited email, text, phone call or letter as an attempt to rob you even if it isn't.
It's likely that the data compromised within M&S contained the last four digits of people's card details. It also seems likely that M&S refused to pay the ransom so the...