Marks & Spencer cyberattack to cost $403 million in operating profit

The British retailer will try to mitigate the impact with cost savings and insurance payouts, it said

Marks & Spencer
Marks & Spencer’s shares have fallen 10% since the attack, though they are still up 34% over the past year through Tuesday’s close. Image: Bloomberg
Bloomberg
2 min read Last Updated : May 21 2025 | 1:03 PM IST
By Katie Linsell
 
Marks & Spencer Group Plc is facing a £300 million ($403 million) hit to operating profit this fiscal year from a cyberattack that’s still disrupting the company’s sales and operations.
 
The British retailer will try to mitigate the impact with cost savings and insurance payouts, it said Wednesday. Online clothing and home orders, which account for more than £3 million of sales a day and have been suspended for more than three weeks, will be disrupted into July.
 
It is a major setback for a business that was delivering on Chief Executive Officer Stuart Machin’s turnaround plan, recording the highest pretax profit in 15 years last fiscal year that ended before the attack. Shoppers have been buying more groceries and the brand has shaken off its reputation for dowdy clothes. 
 
While M&S called it a “bump in the road” on Wednesday, the repercussions have grown since it first said it was facing a cyber incident on April 22, forcing it to halt contactless payments and creating gaps on shelves as it took some IT systems offline. Last week it said some personal customer data was stolen.
 
Food sales have been impacted by reduced availability, although this is improving. The business also incurred additional waste and logistics costs as it switched to manual processes, impacting profit.
 
Marks & Spencer’s shares have fallen 10 per cent since the attack, though they are still up 34 per cent over the past year through Tuesday’s close.  
 
A cybercrime gang known as “DragonForce” has taken credit for the M&S hack, as well as other attempts to infiltrate grocer Co-op Group and luxury department store Harrods Ltd. The group told Bloomberg it carried out the attacks with partners to extort money from victims and plans to hit the UK’s retail sector again, saying the recent breaches were “just a start.” 
 
M&S reported £876 million in pretax profit for the financial year ending in March, beating analyst estimates. The company said it’s confident in prospects for medium-term growth, and is increasing its dividend by 20 per cent.
 
*Subscribe to Business Standard digital and get complimentary access to The New York Times

Smart Quarterly

₹900

3 Months

₹300/Month

SAVE 25%

Smart Essential

₹2,700

1 Year

₹225/Month

SAVE 46%
*Complimentary New York Times access for the 2nd year will be given after 12 months

Super Saver

₹3,900

2 Years

₹162/Month

Subscribe

Renews automatically, cancel anytime

Here’s what’s included in our digital subscription plans

Exclusive premium stories online

  • Over 30 premium stories daily, handpicked by our editors

Complimentary Access to The New York Times

  • News, Games, Cooking, Audio, Wirecutter & The Athletic

Business Standard Epaper

  • Digital replica of our daily newspaper — with options to read, save, and share

Curated Newsletters

  • Insights on markets, finance, politics, tech, and more delivered to your inbox

Market Analysis & Investment Insights

  • In-depth market analysis & insights with access to The Smart Investor

Archives

  • Repository of articles and publications dating back to 1997

Ad-free Reading

  • Uninterrupted reading experience with no advertisements

Seamless Access Across All Devices

  • Access Business Standard across devices — mobile, tablet, or PC, via web or app

More From This Section

Topics :Marks & SpencerCyberattacksGlobal cyberattacks

First Published: May 21 2025 | 1:02 PM IST

Next Story