Marks & Spencer up 2.5% after click-and-collect service is restored after hack

Marks & Spencer Group PLC shares rose 2.5% after fully restoring its Click & Collect service, nearly four months after a crippling cyberattack disrupted its online operations, including online orders and contactless payments. The attack, which also led to an estimated £300 million in lost profits and customer data theft, had seen home delivery restored earlier. The share price bounce indicates investor relief that the company's critical online functions are now entirely operational following the prolonged disruption.

Analysis

Marks & Spencer Group PLC (LSE:MKS) shares rose 2.5% to 339.1p, reflecting investor relief as the company fully restored its Click & Collect service, concluding a nearly four-month disruption from a major cyberattack. This operational recovery is a significant milestone, as the attack in late April had paralyzed online orders and payments. However, the incident inflicted substantial damage, resulting in an estimated £300 million in lost profits and the theft of customer data, which introduces potential reputational and regulatory risks. While management is optimistic about recovering about half of the lost profits, the full financial and brand impact remains a critical consideration. The share price bounce indicates the market is pricing in the end of operational uncertainty, but the underlying costs and vulnerabilities exposed by what the Chair termed a "traumatic" event will likely weigh on the company's medium-term fundamentals and investor sentiment.

Key Decisions for Investors

• While the service restoration removes a major operational overhang and may stabilize the share price, investors should monitor upcoming earnings for clarity on the recovery of the £300 million profit hit.
• The theft of customer data introduces a lingering risk; it is prudent to watch for any disclosures regarding regulatory scrutiny, potential fines, or costs associated with shoring up consumer trust.
• Given the severity of the breach, long-term investors should assess management's future capital allocation towards cybersecurity infrastructure, as this has become a critical factor for the company's risk profile and valuation.