India's TCS says none of its systems were compromised in M&S hack

Tata Consultancy Services (TCS) has stated that its systems and users were not compromised in the cyberattack that affected its client, Marks and Spencer (M&S), clarifying that the investigation's scope does not include TCS. This is TCS's first public statement on the breach, which M&S estimates will cost approximately £300 million in lost operating profit and disrupt online services until July; TCS is a technology services provider for M&S and reportedly won a $1 billion contract in early 2023 to modernize M&S's technology.

Analysis

Tata Consultancy Services (TCS.NS) has publicly clarified that none of its systems or users were compromised in the cyberattack that impacted its client, Marks and Spencer (MKS.L), a statement delivered by independent director Keki Mistry during the company's annual shareholder meeting. This assertion is critical for TCS, as the IT services provider secured a significant contract reportedly worth $1 billion in early 2023 to modernize M&S's technology and supply chain. The denial distances TCS from direct responsibility for the breach, which M&S disclosed in April as a 'highly sophisticated and targeted' attack projected to cost approximately £300 million ($403 million) in lost operating profit, with service disruptions anticipated to extend until July. Despite TCS's current position that the investigation's purview does not include them, a Financial Times report last month indicated TCS was internally investigating whether it had inadvertently served as a gateway for the attack. The market's 'moderately positive' sentiment (0.4 score) likely reflects relief following TCS's statement, mitigating immediate concerns about a direct compromise of TCS's own infrastructure. The absence of Tata Group Chairman N Chandrasekaran from the AGM, attributed to 'exigencies' related to an unrelated Air India incident, was also noted.

Key Decisions for Investors

• For TCS investors, the company's denial of system compromise is a near-term positive, but continued monitoring of any developments from the M&S investigation and potential reputational impacts is warranted.
• Investors in M&S should closely track the actual financial impact against the projected £300 million loss and the timeline for full restoration of online services, as these are key to the retailer's recovery.
• The incident highlights persistent cybersecurity risks in the IT services sector; investors should scrutinize the robustness of cybersecurity measures for both service providers and their enterprise clients.
• Given the prior report of TCS investigating a potential gateway role, investors should remain vigilant for any further disclosures from M&S or TCS that could clarify the pathway of the attack and any indirect involvement.