Tata Consultancy Services Denies Link to Marks & Spencer Cyberattack

Strategic Insights -

Tata Consultancy Services (TCS), India's largest IT services provider, has been implicated as the entry point for a cyberattack on Marks & Spencer (M&S) that led to the shutdown of the retailer's online operations and a loss of £300 million. The attack, which occurred in April 2025, has been linked to TCS, which has provided services to M&S for over a decade, including running its technology helpdesk. However, the company has denied any link between the cyberattack and the termination of its service desk contract with M&S in July.

Key Takeaways:

  • Tata Consultancy Services (TCS) has denied any link between the cyberattack on Marks & Spencer (M&S) and the termination of its service desk contract with the retailer in July.
  • The cyberattack, which occurred in April 2025, led to the shutdown of M&S's online operations and a loss of approximately £300 million.
  • TCS has provided services to M&S for over a decade, including running its technology helpdesk, as well as agreements on cloud services and data centres.
  • As of September, TCS provided services to 211 British-based companies under contracts valued at nearly £3.7 billion.
  • M&S terminated its service desk contract with TCS after a "regular competitive" process initiated in January, which was completed prior to the cyberattack in April 2025.
  • TCS has described the reports of a link between the cyberattack and the termination of the contract as "misleading".
  • A spokesperson for M&S stated that the company followed a thorough process in selecting a new provider and instructed a new provider this summer.

Statistics:

  • £300 million: The estimated loss to Marks & Spencer due to the cyberattack.
  • £3.7 billion: The total value of TCS contract with British-based companies, including 211 companies.
  • £3,700,000,000: The total value of TCS contracts in GBP.
  • 211: The number of British-based companies that TCS provided services to under contracts valued at nearly £3.7 billion.
  • 2025: The year in which the cyberattack occurred.
  • July: The month in which TCS's service desk contract with M&S was terminated.

Sources:

  • The Telegraph
  • Tata Consultancy Services

Note: The original article does not contain specific dates for the sources, therefore none were added.