M&S website down following disruptions after cyber attack

Marks & Spencer's website is currently down, exacerbating ongoing disruptions following a cyber-attack last month attributed to the Scattered Spider hacking group. M&S estimates the attack will reduce this year's profits by approximately £300 million, a figure exceeding analyst expectations and representing about a third of its profit. The company anticipates continued online service disruptions until July, with stolen customer data potentially including telephone numbers, addresses, and order histories, though not payment details or passwords.

Analysis

Marks & Spencer (M&S) is experiencing a complete shutdown of its website, compounding existing operational disruptions stemming from a significant cyber-attack last month attributed to the 'Scattered Spider' hacking group. The retailer has quantified the financial repercussions, estimating a substantial £300 million reduction in this year's profits, a figure that surpasses analyst expectations and constitutes approximately one-third of its anticipated profit. This financial impact will only be partially mitigated by insurance payouts. M&S anticipates that its online services will remain impaired until July, with a gradual restoration process. The cyber-attack also resulted in the theft of personal customer data, including telephone numbers, home addresses, dates of birth, and online order histories, although useable payment details and account passwords were reportedly not compromised. This incident, which initially affected click-and-collect and contactless payments over the Easter weekend, has led to weeks of inability for customers to place online orders, reflecting a severe blow to M&S's e-commerce operations and highlighting significant cybersecurity vulnerabilities, even as the company describes the attack as highly sophisticated and targeted.

Key Decisions for Investors

• Investors should anticipate a material negative impact on M&S's current fiscal year earnings due to the £300m profit warning and prolonged online sales disruption, and monitor for any revisions to this estimate or the July recovery timeline.
• Consider the potential for lasting damage to consumer trust and brand reputation stemming from the data breach and extended service outage, which could impact customer loyalty and online sales growth even after services are restored.
• Factor in the increased operational risk profile for M&S and anticipate higher future capital expenditures on cybersecurity and IT infrastructure, noting that current insurance will not fully cover the financial losses from this attack.