M&S's £300M ransomware attack — a cyber breach that nearly halved its profits

In April 2025, Marks & Spencer, the 140-year-old British retail institution, was hit by a ransomware attack carried out by the Scattered Spider gang. The attackers gained access over the Easter weekend, encrypting parts of M&S's infrastructure. Customers reported payment issues and delays in online orders, and the company was forced to freeze its online clothing store for 46 days while rebuilding core systems from scratch.

The financial impact was severe. M&S warned investors of a potential £300 million profit hit, with direct costs estimated at £136 million. Underlying pre-tax profits tumbled 55.4% to £184.1 million in the six months following the attack. The UK's Cyber Monitoring Centre classified the combined damage from attacks on M&S and Co-op at between £270 million and £440 million. Warehouse systems went offline, shelves emptied in some stores, and the company's digital transformation — a key pillar of its turnaround strategy — was effectively reset to zero.

The attack exploited a gap in M&S's cybersecurity posture. The company had invested heavily in store refurbishment and product innovation but had treated cybersecurity as a back-office cost rather than an operational risk. The 46-day online store closure was not just a revenue loss — it was a customer trust event, as shoppers who had moved to online ordering during the disruption had to find alternatives.