Marks & Spencer Cyber-attack Case Study

Incident sequence

1. 01

   Social engineering opened the initial path

   M&S chairman Archie Norman told Parliament that the attackers gained initial access on 17 April through sophisticated impersonation and social engineering involving a third party. He said the attackers presented themselves as a legitimate individual with convincing personal details rather than simply requesting an obvious password reset.

2. 02

   Detection triggered deliberate containment

   M&S identified the intrusion on 19 April and convened its first crisis-management meeting that evening. The company subsequently disconnected systems and restricted third-party access as containment measures. M&S emphasised that much of the business disruption resulted from its own decision to take potentially exposed systems offline rather than allowing the attackers continued access.

3. 03

   Technology disruption became retail disruption

   The incident affected contactless payments, Click & Collect, online ordering, warehouse management, stock allocation, forecasting, ordering, and replenishment. M&S paused new online orders on 25 April and introduced manual processes to keep stores trading. Fashion, Home & Beauty online operations were paused from late April into early June, with home delivery restored first and Click & Collect returning in August.

4. 04

   Customer data was stolen and recovery lasted months

   M&S later confirmed that customer information had been taken, potentially including contact details, dates of birth, and online order history, although usable payment-card details and account passwords were not included. The company rebuilt or restored systems progressively through the summer and continued technology recovery work for months. Its 2025/26 results recognised £131.3 million of incident-related costs alongside £100 million of insurance proceeds.