M&S cyberattack to wipe out nearly one-third of annual profits

Marks & Spencer announced that a recent cyberattack is projected to reduce its 2025/26 operating profit by £300 million, equating to 30.5% of its annual operating profit as of March 29, 2025, despite a 17% year-on-year increase. The attack, which occurred over Easter, has already wiped over £1 billion from the company's market value and is disrupting online sales into July, prompting M&S to accelerate its technology transformation program; the incident underscores growing concerns about cyber threats among retailers, as noted by analysts and other companies like JD Sports.

Analysis

Marks & Spencer has disclosed a significant financial setback resulting from a recent cyberattack, projecting a £300 million reduction in its 2025/26 operating profit before mitigation measures. This forecasted impact represents a substantial 30.5% of its £984.5 million annual operating profit (as of March 29, 2025), which had otherwise demonstrated robust underlying performance with a 17% year-on-year increase. The cyberattack, which occurred over Easter, has already erased over £1 billion from M&S's market capitalization and is causing ongoing disruptions to its online retail operations, expected to persist into July. In response, CEO Stuart Machin announced an accelerated technology transformation, condensing a two-year plan into six months, citing the incident as an opportunity despite its "human error" origin. The company has stated it will manage costs and utilize insurance to reduce the financial blow, treating incident-related costs as an adjusting item. This event, characterized by a negative sentiment score of -0.5 and a notable market impact score of 0.6, underscores the escalating cyber threat landscape for retailers, as similar incidents have affected peers and JD Sports has highlighted cyberattacks as a "severe but plausible" downside risk. While an equity research analyst from Quilter Cheviot noted the attack "overshadowed" otherwise solid annual results and suggested much of the impact was priced in, uncertainty regarding the full duration and potential further risks persists, leaving M&S vulnerable, although shares saw a minor uptick of 0.68% following the news.

Key Decisions for Investors

• Investors should closely monitor Marks & Spencer's execution of its accelerated technology transformation program and its effectiveness in mitigating further cyber threats and operational disruptions.
• Scrutinize upcoming financial disclosures for the actual net cost of the cyberattack after cost management, insurance recoveries, and other trading actions, as this will determine the ultimate impact on profitability beyond the initial £300 million estimate.
• Consider the balance between the severe profit warning and the underlying 17% pre-incident operating profit growth, assessing if the current stock valuation adequately reflects both the cyberattack's impact, which analysts suggest may be partly priced in, and the company's recovery potential.
• Evaluate the persistent uncertainty regarding the duration of online sales disruption and the potential for further market risks related to this incident before adjusting positions.