The Home Office’s proposals come after Marks & Spencer refused to say if it had paid a ransom to hackers in a major attack earlier this year.