M&S Cyber Attack One of the Costliest in UK Retail History
Marks & Spencer, one of the UK’s largest retailers, has finally resumed online orders across England, Scotland and Wales, bringing an end to a six-week digital blackout that devastated the company’s profits.
The high street giant was forced to completely halt all online operations in April following a sophisticated cyber attack attributed to the Scattered Spider hacking group.
The attacks have targeted other supermarkets and suppliers in Britain’s economy too, with the Co-op and Peter Green Chilled experiencing empty shelves and ransomware problems respectively.
The attack targeted the company through a third-party contractor's systems, highlighting the growing threat posed by supply chain vulnerabilities in an increasingly connected business environment.
A gradual and tentative return to normality
Customers can now place orders for home delivery through the M&S website for the first time since the attack struck over Easter weekend.
However, M&S have stated that shoppers will have to wait longer for the full range of services to return, with click-and-collect, next-day delivery and other premium options expected to resume “in the coming weeks”.
John Lyttle, M&S’s Managing Director of Fashion, Home & Beauty, took to social media to announce that a selection of the retailer's best-selling fashion ranges would also be available for home delivery from today.
The financial toll of the cyber attacks
In the UK, the cyber attack has been one of the most financially devastating in recent memory, inflicting severe financial damage on the 140-year-old retailer.
The losses mounted to an estimated £25m (US$33.7m) per week in clothing and homewares sales alone.
M&S now expects the incident to cost the company a staggering £300m (US$404m) in lost profits by July.
Before the cyber attacks, Marks & Spencer had been performing very well financially, especially when compared to the plight of other British department stores, like BHS or House of Fraser.
The company had recorded annual growth year on year since 2021, posting profits of £875.5m (US$1.18bn) before tax and adjusting items in March this year — a 22.2% increase from 2024.
Nevertheless, these lost sales are likely to shake the retailer to its core.
“The shelves might get restocked, but the long-term effects ripple through every part of the business,” says Dustin Kluttz, Senior Cybersecurity Strategist at Cybersecure.
Is this a wake-up call for the industry?
Cybersecurity experts have pointed to the M&S incident as a stark reminder of the vulnerabilities facing even the most well-established retailers today.
The attack has raised serious questions about customer data protection and whether consumers will feel safe sharing personal information with the retailer going forward.
“Will this be the watershed moment where companies start to take cybersecurity seriously, at least in the UK?,” asks John Marsh, Technology Director at SRC.
Industry professionals are calling for businesses across all sectors to reassess their digital infrastructures and strengthen defenses against increasingly sophisticated cyber threats.
“On a professional level it is important to make sure that businesses understand the damages a cyber attack can cause a business, not just in the short term but in the long term too,” explains Doriane Alba, Customer Success Manager & Head of Strategic Partnerships at RiskImmune.
Explore the latest edition of Technology Magazine and be part of the conversation at our global conference series, Tech & AI LIVE.
Discover all our upcoming events and secure your tickets today.
Technology Magazine is a BizClik brand
