Marks & Spencer Cyberattack: What Happened and How to Protect Your Business

In April 2025, Marks & Spencer (M&S), one of the UK’s most iconic retailers, was hit by a devastating cyberattack that sent shockwaves through the retail industry. This “highly sophisticated and targeted” breach, attributed to the hacking group Scattered Spider, has disrupted M&S’s operations, halted online orders, and is projected to cost the company around £300 million ($403 million) in lost profits. With disruptions expected to persist until July, this incident serves as a stark reminder of the vulnerabilities businesses face in today’s digital landscape. Here’s what happened, why it matters, and how you can safeguard your organization from similar threats.

What Happened to Marks & Spencer?

The cyberattack on M&S began over the Easter weekend in April 2025, when the retailer detected suspicious activity in its IT systems. According to reports, hackers gained access not through a flaw in M&S’s own systems but via a third-party contractor, Tata Consultancy Services (TCS), which manages M&S’s IT helpdesk. The breach was facilitated by “human error” and social engineering tactics, where hackers tricked employees into providing login credentials, possibly through phishing or SIM-swapping techniques.

The attack, identified as a ransomware incident, compromised customer data, including names, email addresses, and postal addresses, though M&S confirmed that no payment details or passwords were stolen. The fallout was severe: online ordering was suspended, contactless payments and Click and Collect services were disrupted, and some stores faced empty shelves. The financial impact is estimated at £300 million, with M&S’s stock market value taking a hit of over £1 billion. The Metropolitan Police are investigating, with suspicions pointing to Scattered Spider, a notorious hacking collective known for targeting major organizations.

This wasn’t an isolated incident. Retailers like Co-op and Harrods were also hit by similar cyberattacks around the same time, suggesting a broader wave of attacks targeting UK businesses. As M&S chief executive Stuart Machin noted, the retailer was in its “best financial health for nearly 30 years” before the attack, making the disruption particularly untimely.

Why This Matters for Businesses and Consumers

The M&S cyberattack underscores several critical lessons for businesses and consumers alike:

1. Third-Party Risks: The breach originated through a third-party vendor, highlighting the vulnerability of supply chains. Even if your systems are secure, a weak link in your vendor network can expose you to significant risks.

2. Human Error as a Weak Point: Hackers exploited social engineering, a tactic that relies on manipulating people rather than breaking through technological defenses. This shows that employee training is just as crucial as robust software.

3. Financial and Reputational Damage: The £300 million loss and ongoing disruptions demonstrate the high cost of cyberattacks, not just in immediate financial terms but also in lost customer trust and market value.

4. Consumer Impact: Shoppers were left unable to place online orders, and those affected by the data breach now face heightened risks of phishing scams and fraud. M&S has urged customers to stay vigilant for suspicious emails.

This incident is a wake-up call for businesses to reassess their cybersecurity strategies and for consumers to be proactive in protecting their personal information.

How to Protect Your Business from Cyberattacks

The M&S breach is a reminder that no organization is immune to cyber threats. Fortunately, there are steps you can take to fortify your defenses and reduce the risk of a similar attack. Here’s how:

1. Strengthen Employee Training

Since human error played a role in the M&S hack, regular cybersecurity training is essential. Teach employees to recognize phishing emails, avoid suspicious links, and verify requests for sensitive information.

2. Secure Third-Party Vendors

Vet your vendors’ cybersecurity practices thoroughly. Ensure they comply with industry standards and conduct regular audits.

3. Implement Multi-Factor Authentication (MFA)

MFA adds an extra layer of security by requiring multiple forms of verification. This can prevent unauthorized access even if login credentials are compromised.

4. Deploy Advanced Threat Detection

Invest in tools that detect and respond to suspicious activity in real time. Intrusion detection systems and endpoint protection can catch threats early.

5. Prepare for Ransomware

Ransomware attacks, like the one suspected in the M&S breach, can cripple operations. Regular backups, incident response plans, and anti-ransomware tools are critical.

6. Educate Consumers

If you’re a retailer, communicate clearly with customers about data breaches and offer guidance on avoiding scams. Transparency builds trust and helps mitigate reputational damage.

Take Action Today

The Marks & Spencer cyberattack is a sobering reminder that cyber threats are evolving, and no business is too big to fail. By investing in robust cybersecurity measures, you can protect your operations, safeguard customer data, and avoid the costly consequences of a breach. Our suite of cybersecurity resources

can help you stay one step ahead of hackers.

Don’t wait for a cyberattack to disrupt your business. Visit our website to explore our comprehensive cybersecurity solutions and start building a stronger defense today. Together, we can make sure your organization doesn’t become the next headline.

Sources: BBC News, The Guardian, Reuters, The Independent, TechRadar