Marks & Spencer (M&S) has announced that its online services will continue to experience disruptions until July 2025, following a sophisticated cyber attack that occurred during Easter weekend. The retailerโs online ordering capabilities have been unavailable for nearly a month, with plans for a gradual restoration of services.
Ongoing Disruptions
The disruption was attributed to a significant cyber attack that impacted online ordering, click-and-collect services, and contactless payments. M&S Chief Executive Stuart Machin confirmed that the company anticipates these issues to persist throughout June and into July as they work to restart and ramp up operations. โWe expect online disruption to continue throughout June and into July as we restart, then ramp up operations,โ he stated.
Analysts estimate the financial repercussions of the attack could amount to approximately ยฃ300 million, equivalent to about one-third of M&Sโs projected profit for the year. This figure surpassed previous estimates.
Details of the Cyber Attack
Machin described the attack as โhighly sophisticated and targeted.โ He noted how the cyber incident involved social engineering techniques, where attackers exploited human vulnerabilities rather than purely technological exploits. The hackers gained access to M&Sโs systems via a third-party associate, heightening concerns over cybersecurity protocols within the retail sector.
The company had previously conducted cyber attack simulations to prepare for such incidents, which Machin credited with enabling a swift response to the attack. โWe were able to respond quickly and take the right actions immediately,โ he said. Following the attack, M&S decided to take their online system offline to protect customers and the integrity of their website.
Response to the Incident
M&Sโs management is now focusing on addressing the vulnerabilities exposed by the incident. Machin emphasized that despite the financial impact, the company would use this experience to bolster its operations and cybersecurity measures. โThis incident is a bump in the road, and we will come out of this in better shape,โ he said.
Scattered Spider, a hacker collective implicated in previous attacks against several organizations, including Co-op and Harrods, is widely believed to be responsible for the attack. Despite M&S suffering the most damaging impact, the ongoing investigation is a priority for law enforcement.
Financial Implications and Future Strategies
The financial implications of the cyber attack extend beyond immediate losses. M&Sโs turnaround strategy, initiated by Machin in 2022, aims to enhance operational efficiency through updated in-store offerings and an overhaul of its digital capabilities. This strategy reportedly positioned M&S in its best financial standing nearly three decades before the attack.
For the fiscal year ending in March 2025, M&S reported a 22% rise in profit before tax to ยฃ875 million, with total sales increasing by 6.1% to ยฃ13.9 billion. However, the company noted a pre-tax profit decline of 23.9% to ยฃ511.8 million, reflecting one-off costs associated with the cyber attack.
Machin acknowledged that while insurance may cover about a third of the financial implications from the incident, additional costs related to potential fines, litigation, and future-proofing efforts to defend against subsequent attacks must be considered.
โIn many ways, the incident allows us to accelerate the pace of change as we draw a line and move on,โ Machin concluded.
As M&S navigates this challenging period, it will continue to adapt its strategies to enhance resilience against future cyber threats while restoring its online services for customers.
For more business News, checkย PGN Business Insider.
