Marks and Spencer Hit by Ransomware Attack, Customer Information Compromised

Strategic Insights -

British retailer Marks and Spencer has suffered a significant cyber attack, which has crippled its online operations for over three weeks. The attack, believed to be a ransomware attack, has resulted in the compromise of some customer personal information. Despite reassuring customers that no payment or card details were stolen, the incident has led to a 15% decline in the company's share price since the Easter weekend.

Key Takeaways:

  • Marks and Spencer's online operations have been disrupted for over three weeks, with customers unable to place orders since April 25.
  • The cyber attack is believed to be a ransomware attack, where criminals infiltrate companies' computer systems, encrypt them, and demand payment before allowing control to be regained.
  • Some customer personal information has been compromised, but payment or card details were not stolen, according to the company.
  • The data breach has not been shared, and there is no evidence to suggest that it has been used for malicious purposes.
  • Customers have been advised not to take any action, but work is continuing to get operations back to normal.
  • Marks and Spencer has declined to quantify the financial impact of the attack, but analysts estimate it could be at least £30 million (€33.5 million).
  • Cyber insurance is likely to cover most of the impact, but coverage is generally provided for a limited amount of time.
  • The company has taken steps to protect its systems, including working with cybersecurity experts, law enforcement, and government agencies.

Statistics:

  • Marks and Spencer's share price has fallen by 15% since the Easter weekend.
  • The company's online sales account for around one-third of its clothing and home sales.
  • Analysts estimate the profit hit from the cyber attack to be at least £30 million.
  • The weekly run rate for the financial impact is estimated to be around £15 million.
  • Cyber insurance is likely to cover most of the financial impact, but cover is generally provided for a limited amount of time.

Sources:

  • Marks and Spencer, statement, Tuesday (no date provided)
  • Deutsche Bank, analyst report, earlier this month (no specific date provided)
  • Bloomberg, article, Tuesday