In April 2025, Marks & Spencer, the 140-year-old British retail institution, was hit by a ransomware attack carried out by the Scattered Spider gang. The attackers gained access over the Easter weekend, encrypting parts of M&S's infrastructure. Customers reported payment issues and delays in online orders, and the company was forced to freeze its online clothing store for 46 days while rebuilding core systems from scratch.
The financial impact was severe. M&S warned investors of a potential £300 million profit hit, with direct costs estimated at £136 million. Underlying pre-tax profits tumbled 55.4% to £184.1 million in the six months following the attack. The UK's Cyber Monitoring Centre classified the combined damage from attacks on M&S and Co-op at between £270 million and £440 million. Warehouse systems went offline, shelves emptied in some stores, and the company's digital transformation — a key pillar of its turnaround strategy — was effectively reset to zero.
The attack exploited a gap in M&S's cybersecurity posture. The company had invested heavily in store refurbishment and product innovation but had treated cybersecurity as a back-office cost rather than an operational risk. The 46-day online store closure was not just a revenue loss — it was a customer trust event, as shoppers who had moved to online ordering during the disruption had to find alternatives.
The attack cost £300M in profit and a 55.4% drop, as M&S had treated cybersecurity as a cost centre, not a risk, with no viable disaster-recovery plan.
M&S treated cybersecurity as a cost centre, not a risk — the investment in firewalls and incident response never kept pace with the complexity of the infrastructure being protected
The 46-day offline period showed that M&S had no viable disaster-recovery plan for its e-commerce platform — a single point of failure for a modern retailer
The attack exploited a 'just enough' security posture — compliant with minimum standards, but not designed to withstand a determined ransomware gang
A retailer's digital infrastructure is its storefront — and a ransomware attack that closes it for 46 days reveals that 'just enough' security is not enough at all
FOLLOW THE EVIDENCE