M&S said earlier this week that the hackers got into systems via a third party – but did not say who that was.