M&S let a contractor's help desk reset any password by phone — hackers just asked

Around Easter weekend 2025, the hacking group Scattered Spider breached Marks & Spencer not through a technical exploit but by calling the IT help desk M&S had outsourced to Tata Consultancy Services and impersonating an M&S employee. The help desk carried out a password reset for the caller. Reuters later reported that logins belonging to at least two TCS employees were used in the intrusion. M&S chairman Archie Norman described it to UK lawmakers as a 'sophisticated impersonation' operation 'involving a third party' — naming the method without naming the weak point.

Once inside, the attackers deployed DragonForce ransomware. M&S switched off its automated stock and inventory systems rather than risk them spreading the attack further, so staff fell back to manual, pen-and-paper processes to move fresh food, drinks and clothing through stores and warehouses. Online clothing and home ordering was suspended for weeks; food and beauty online sales were disrupted longer. A month after the attack, M&S's online clothing service was still offline.

M&S put the cost at roughly £300 million (about $400 million) in lost operating profit across 2025 and 2026, which it hoped to roughly halve through insurance and cost management. The Cyber Monitoring Centre later assessed the combined damage from the M&S attack and a related one at the Co-op — same threat actor, similar timeline, similar techniques — at £270–440 million across the two retailers. M&S's market value fell by more than £1 billion.

Six months after the attack, M&S ended its help-desk services contract with TCS. Both companies stated the decision predated the breach and was not a response to it, but the timing left the outsourced help desk — the actual entry point — as the visible casualty of a breach whose root cause was a process, not a system.