Marks & Spencer has warned that a cyber-attack will cost it an estimated £300 million in lost profits this year, with disruption to its online business expected to continue into July. The retailer's chief executive, Stuart Machin, revealed that 'threat actors' gained access via a contractor using social engineering techniques, including posing as staff to fool a helpdesk.
M&S disclosed the details alongside annual results showing underlying profits rose 22% to £876 million in the year to 30 March. The company had over £400 million in net funds before the attack, which it described as its best financial health in 30 years. It aims to halve the financial impact to about £150 million through insurance and cost reductions.
Machin said the hack was not due to a weakness in M&S's own IT systems but via a third party, understood to be Tata Consulting Services (TCS), which manages its helpdesk. Two employee logins were used in the breach, according to a Reuters report; TCS declined to comment. The attack forced M&S to stop website orders and disrupted deliveries to stores and Ocado.
M&S admitted that personal information of thousands of customers—including names, addresses, dates of birth, and order histories—was taken. Machin said the website should reopen 'within the next few weeks' and all product categories should be selling before July. He described the £300 million hit as a 'one-off' and 'not significant' to the business overall.
Machin ruled out job cuts or reductions in store refurbishments to offset costs. Instead, M&S is accelerating IT investment, condensing two years of system updates into six months. Analysts expect to cut profit forecasts for this year by at least 10%. The cyber-incident interrupted a strong trading period, with overall sales up 6% to £13.9 billion for the year.
