Retail · 2025
Marks & Spencer: cyberattack disrupted online orders
Forty-six days without online orders.
What happened
In April 2025, Marks & Spencer experienced payment and Click & Collect problems, then suspended online and app orders while it contained a cyberattack. Stores relied on manual stock processes, product availability suffered and online ordering did not resume until June 10, 46 days later. M&S also confirmed that some customer personal data was stolen, without publishing a total number of affected customers.
M&S's chairman told Parliament that the attackers gained initial access on April 17 through sophisticated impersonation, social engineering and a third party. The campaign used methods associated with Scattered Spider and DragonForce ransomware, then expanded from a trusted identity into the retailer's wider environment. UK authorities arrested four people in July 2025 as part of their investigation.
M&S initially forecast a roughly £300M reduction in operating profit before mitigation. Its full-year results for the period ending March 2026 later reported £131.3M in incident-related costs.
What would have changed it
Third-party support and legacy systems are part of the same attack surface. We test identity recovery, supplier controls, segmentation and the manual procedures that keep sales moving.