Marks and Spencer faces £300m setback from cyberattack

Marks & Spencer has revealed that the recent cyberattack on its systems will cost the company £300 million, dealing a heavy blow to its bottom line and shareholder confidence. The attack, which took place over the Easter weekend, has caused ongoing disruption, particularly to online sales and supply chain operations, with normal functionality not expected to resume until July.

The breach, attributed to the hacking group known as Scattered Spider, has reportedly impacted multiple high-profile businesses in the UK and abroad. The group, which includes English-speaking members and, alarmingly, teenagers, managed to access M&S’s systems via a third-party contractor, exposing vulnerabilities. The National Crime Agency, alongside the FBI, is currently investigating the attack as they seek to track down the perpetrators.

M&S confirmed that it has a £100 million cyberinsurance policy, which will offset some of the financial impact. Chief Executive Stuart Machin stated that the breach was due to “human error” within the company’s third-party access protocols, stressing that M&S had not neglected its cybersecurity measures. Although Machin described the incident as a “bump in the road,” the scale of the disruption has left key shareholders voicing concerns over the company’s handling of the situation.

Customers have faced challenges as a result of the attacks, with some stores reporting empty shelves while supply chains struggled under manual operating systems. Popular items, including Percy Pigs, have been missing from shelves, adding to consumer frustration during the fallout. However, M&S has confirmed that food store operations have largely stabilised in recent weeks.

Investor confidence has taken a hit, with M&S shares falling 11% since the attack, wiping more than £1 billion off its market value. This comes at a particularly challenging time for the retailer, which had been making strides in its turnaround strategy. In its latest full-year results to March, M&S reported a 22% rise in headline profits to £875.5 million, the highest level in over 15 years. Yet statutory pre-tax profit dropped by 23.9%, largely due to a £248.5 million impairment on its Ocado Retail stake.

The £300 million cost of recovery and reputational repair now threatens to derail some of M&S’s recent progress, even as Machin insists that the company is “in a stronger financial position” to weather the storm. Plans for capital investment, which were expected to increase to £650 million this year, will now need to accommodate extensive recovery efforts. Executive pay has also come under scrutiny, with Machin set to lose £1 million in incentives related to the group’s compromised performance metrics.

As M&S works to resolve the aftermath of the breach, pressure mounts to reassure both shareholders and customers about the long-term resilience of the brand. Shareholders have called for more decisive communication and tighter scrutiny over third-party collaborations to prevent similar breaches in the future. A full recovery will be critical to maintaining investor trust and continuing the company’s modernisation plans.