M&S said earlier this week that the hackers got into systems via a third party - but did not say who that was.