UK's M&S resumes online orders following cyber incident

Marks & Spencer (MKS.L) has resumed online orders for select clothing lines after a 46-day suspension following a cyberattack that began in late April. The company anticipates the attack will negatively impact operating profit by approximately £300 million in the 2025/26 financial year, though it aims to mitigate half of the losses through insurance and cost control. The cyberattack, which targeted a third-party contractor, caused disruptions to online and contactless services.

Analysis

Marks & Spencer (MKS.L) has resumed taking online orders for select clothing lines as of Tuesday, following a significant 46-day interruption that began on April 25th due to a cyberattack. The company, a 141-year-old stalwart in British retail, had first disclosed the "cyber incident" on April 22nd, which also impacted contactless payment and click-and-collect services. Despite this partial resumption, M&S anticipates a substantial financial blow, forecasting the attack will cost approximately £300 million ($404 million) in lost operating profit for its 2025/26 financial year. Management expressed hopes to mitigate about half of this impact through insurance recoveries and stringent cost control measures. The security breach originated from hackers deceiving employees at a third-party contractor, thereby circumventing M&S's direct digital defenses. This event underscores the persistent threat of cyberattacks and their potential for extensive operational and financial disruption, even for established enterprises.

Key Decisions for Investors

• Investors should closely monitor the speed and breadth of M&S's online sales recovery, particularly for clothing and home goods, to gauge the ongoing impact of the cyberattack.
• The ability of M&S to successfully realize the anticipated £150 million mitigation through insurance claims and cost controls will be critical in buffering the forecasted £300 million profit hit in FY2025/26, and should be tracked.
• Consider the implications of this breach on M&S's cybersecurity posture, potential future investments in this area, and the risks associated with third-party vendor dependencies when evaluating the company's operational risk profile.