Marks & Spencer cyberattack to cost £300 million, disrupt online services

Marks & Spencer on Wednesday warned that the recent cyberattack on its online systems will continue disrupting its online services till July and could cost the retailer as much as £300 million.

The British high street giant also said that the fallout from the incident may significantly impact its operations and revenue in the coming weeks.

“In Fashion, Home & Beauty, online sales and trading profit have been heavily impacted by the necessary decision to pause online shopping, however stores have remained resilient,” the entity said in a statement, quoted by AFP.

Last week, the company revealed that the cyberattack stole personal data belonging to some of its customers.

The company further added that it anticipated "online disruption to continue throughout June and into July as we restart, then ramp up operations."

The ransomware attack, which began around Easter, forced M&S to suspend online sales, contactless in-store payments, and even its recruitment systems. The retailer confirmed that compromised data may include names, birthdates, home addresses, and phone numbers — but reassured customers that no “usable” payment or card details, or account passwords, were accessed.

Despite the challenges, Marks reported operating profit before adjusting items of £985 million for the financial year ending in March. However, it estimated the impact of the cyberattack on full-year group operating profit would be around £300 million. That figure is expected to be partially offset by cost management, insurance recovery, and other commercial actions.

Shares in the company fell 2.5% in early trading following the announcement.

The incident has been reported to law enforcement and relevant government authorities.

Marks & Spencer joins the string of British retailers targeted by cybercriminals in recent weeks, with high-profile breaches also reported by luxury department store Harrods and the Co-op food chain.