M&S cyberattack triggers £300 million blow, online disruptions to last through July

Marks & Spencer disclosed that the cyberattack compromised customer information, severely impacting online sales across its Fashion, Home & Beauty categories, while assuring that physical stores remain unaffected and are continuing to operate normally across the country

British retail giant Marks & Spencer (M&S) has revealed that a recent cyberattack targeting its online services could cost the company an estimated £300 million ($404 million), with disruptions expected to last through July.

The company first disclosed the breach last week, confirming that customer data had been compromised. In its latest update, M&S said online sales across its Fashion, Home & Beauty segments have been significantly affected due to the suspension of digital orders via its website and apps. However, physical stores remain fully operational and continue to serve customers.

“As part of our proactive response to the cyber incident, we have paused online ordering,” the company said. “Our website remains available for browsing, and our stores continue to welcome customers.” M&S apologized for the inconvenience caused and stressed its commitment to restoring online operations as soon as possible.

Cyberattack tied to DragonForce group

The breach is believed to have been carried out by a hacker group identifying itself as “DragonForce,” which has also been linked to cyberattacks on other UK retailers including Co-op and Harrods. Investigations suggest the attackers may have gained access through a third-party system.

The stolen data includes personal information such as names, addresses, phone numbers, and birth dates. M&S clarified that no payment details or account passwords were compromised in the attack.

The retailer expects the online disruption to continue throughout June and into July, gradually resuming operations in stages. The projected financial loss will be partially offset through cost-cutting, insurance, and operational adjustments.

The announcement came as M&S reported an annual operating profit of £985 million for the financial year ending March 2025. Despite strong overall earnings, the cyber incident weighed on investor sentiment, causing the company's shares to fall 2.5% in early London trading.