Marks & Spencer resumes partial online clothing orders after cyberattack

Marks & Spencer has partially restored online clothing orders in Britain after a 46-day disruption caused by a cyberattack in April, which bypassed security measures by targeting a third-party contractor; full services are not yet available in Northern Ireland. The company anticipates the incident could cost it hundreds of millions of pounds.

Analysis

Marks & Spencer (MAKSY) has initiated a partial resumption of its online clothing order services in Britain, following a significant 46-day interruption caused by a ransomware cyberattack in April. The attack, which exploited vulnerabilities through a third-party contractor, has led the company to warn of potential financial damages amounting to hundreds of millions of pounds. While select fashion ranges are now accessible online in Britain, full service restoration is still pending in Northern Ireland, indicating ongoing operational challenges. This event underscores a substantial operational disruption and a considerable financial threat to the retailer, reflected in the moderately negative sentiment (score -0.5) surrounding the company. The reliance on a third-party contractor for system access also brings M&S's vendor risk management and overall cybersecurity posture into sharp focus.

Key Decisions for Investors

• Investors should closely scrutinize Marks & Spencer's forthcoming financial reports for the realized costs of the cyberattack, which are guided to be potentially hundreds of millions of pounds, and assess the impact on profitability.
• Monitor the progress of full online service restoration, particularly in Northern Ireland, as prolonged disruption could further affect revenue and customer loyalty for MAKSY.
• Consider the direct financial hit from the 46-day operational halt and recovery expenses on Marks & Spencer's near-term earnings and re-evaluate exposure to MAKSY accordingly.
• Evaluate Marks & Spencer's disclosed actions to bolster cybersecurity and third-party vendor oversight, as the breach via a contractor highlights significant operational risks to the business.