Sign in Subscribe
Computer hackers

M&S Faces £300m Hit from Cyberattack as Recovery Roadmap Unfolds

Strategic Insights

— 2 min read

The month of April was marked by a turning point in M&S's operations after hackers took over systems, prompting a massive cyberattack that has had far-reaching consequences. The attack, which occurred after compromising log-in details from a third-party contractor, has left the company facing significant losses and a long road to recovery.

Key Takeaways:

  • M&S estimates group operating profit will be hit by £300m due to the cyberattack, but this will be reduced through cost management, trading actions, and insurance recovery.
  • The company's online sales, which account for about a third of clothing and home sales, remain suspended, with in-store trading also being softer than expected.
  • GlobalData senior retail analyst Eleanor Simpson-Gould warns that shoppers may turn to alternative online platforms, such as John Lewis & Partners and Next, despite M&S's efforts to shift customers to physical locations.
  • M&S forecasts online disruption will last until July, with the rebuild involving the cleansing of the company's digital estate, comprising over 600 applications and thousands of servers.
  • The company's website went down for several hours on Wednesday evening as it made overnight updates, a sign of M&S accelerating its upgrade to legacy technology systems.
  • AJ Bell investment analyst Dan Coatsworth warns of a potential financial penalty, with the maximum fine from the Information Commissioner's Office being £17.5m or 4% of M&S's global annual turnover, whichever is higher.
  • M&S has not received any claims regarding the breach, but a law firm in Scotland has vowed to launch a class action lawsuit despite the breach not including card payment details.
  • M&S's chief Stuart Machin is confident that the company will enter the second half of the year with a strong customer proposition and return to pre-incident performance.

Statistics:

  • M&S estimates a £300m hit to group operating profit due to the cyberattack.
  • M&S's online sales account for about a third of clothing and home sales.
  • The company's in-store trading is softer than expected.
  • The rebuild involves cleansing over 600 applications and thousands of servers.
  • M&S's website went down for 7 hours on Wednesday evening.
  • The maximum fine from the Information Commissioner's Office is £17.5m or 4% of M&S's global annual turnover.
  • M&S's global annual turnover is £13.8bn, making the potential fine £552m if 4% of the turnover is used.

Sources:

  • M&S's chief Stuart Machin in an interview with the press
  • GlobalData senior retail analyst Eleanor Simpson-Gould in a statement
  • AJ Bell investment analyst Dan Coatsworth in a statement
  • Thompsons Solicitors' senior partner Patrick McGuire in a statement
  • M&S's annual results on Wednesday
  • Information Commissioner's Office guidelines on data breach fines

Read more