Marks & Spencer Recovers from Cyberattack

May 23, 2025: Marks & Spencer (M&S) has resumed core food deliveries and begun restoring its website following a major cyberattack in April that crippled operations for nearly a month. The retailer estimates a £300 million ($400 million) profit impact from the incident, driven by halted online orders, delivery disruptions, and backend system failures.

Operational Recovery Still Ongoing

While in-store retail remained partially functional, e-commerce was entirely offline, leading to weeks of lost sales across clothing, food, and homeware. M&S expects full digital operations to resume by July, although analysts warn customer churn may persist longer, especially in the online fashion segment.

The attack forced the company to pause new orders, reroute logistics, and resecure internal systems across its IT infrastructure. It is still unclear whether the breach originated directly through M&S systems or through a third-party contractor. An investigation is ongoing, with security teams examining the role of external vendors in the compromise.

Financial and Strategic Implications

In its post-incident disclosure, M&S said the £300 million figure includes lost sales but excludes full insurance recovery and mitigation costs, suggesting further net losses could follow. The company’s shares initially dropped 9% but recovered 2% this week after confirmation that food supply chains had stabilized.

CEO Stuart Machin stated that the business expects to “recover at pace,” with revised contingency protocols embedded across all digital platforms. M&S has accelerated plans to bolster its cyber resilience architecture, including new real-time monitoring systems, third-party risk audits, and multi-cloud recovery protocols.

Sectoral Impact and Future Risk Management

This attack places M&S among a growing list of major UK retailers affected by supply-chain-oriented cyber incidents, reinforcing calls for stricter regulation of third-party tech partners. Analysts argue that reputational damage, particularly for a legacy brand repositioning itself digitally, could be more enduring than the immediate revenue loss.

Regulatory and shareholder pressure will likely push the company to adopt more transparent cyber risk disclosures, as retail supply chains remain high-value targets in an increasingly volatile digital threat landscape.