M&s admits ‘human error’ caused major cyber attack set to cost £300 million

IT AS THE RETAILER WARNS THAT IMPACTS TO ONLINE SHOPPING COULD BE SEEN INTO JULY 12:28, 21 May 2025 Marks and Spencer (M&S) has revealed that the damaging cyber attack was caused by

“human error” is set to cost the company around £300 million. M&S reported that disruption to online shopping could continue into July, but it hopes to have this partly restored “within

weeks”. The high street retail giant stopped orders on its website and saw empty shelves after being targeted by hackers around the Easter weekend. Hackers managed to take customer personal

data, which could have included names, email addresses, postal addresses and dates of birth, in the attack. Chief executive Stuart Machin told reporters that hackers gained access to the

company’s IT systems through a third party after “human error”. The boss said he has been in touch with other industry bosses to discuss hacks, with rivals Co-op and Harrods also targeted

with similar cyber attacks in recent weeks. He said: “We didn’t leave the door open, this wasn’t anything to do with under-investment. Everyone is vulnerable. For us, we were unlucky on this

particular day through some human error.” The retailer revealed on Wednesday morning, May 21, that online sales and profits in its fashion, home and beauty business have been “heavily

impacted”. Disruption to online operations is set “to continue throughout June and into July as we restart, then ramp up operations”, it said. But shoppers should see improvements over the

coming weeks as Mr Machin said that around 85% of its online operations are likely to be restored soon, as the company focuses on certain parts of its operations first. He added that

clothing and home sales have been “resilient” in stores in recent weeks. Meanwhile, food sales were affected by reduced availability but the business stressed this is “already improving”.

M&S said the incident is likely to drag its group operating profits down by around £300 million in total this year, but it expects this to be reduced through cost management, insurance

and other reactions. Mr Machin said: “It has been challenging, but it is a moment in time, and we are now focused on recovery, with the aim of exiting this period a much stronger business.

“There is no change to our strategy and our longer-term plans to reshape M&S for growth and, if anything, the incident allows us to accelerate the pace of change as we draw a line and

move on. “This incident is a bump in the road, and we will come out of this in better shape, and continue our plan to reshape M&S for customers, colleagues and shareholders.” The major

incident came as the company reported a higher-than-expected adjusted pre-tax profit of £875.5 million for the year to March, up 22.2% on the previous year. The group was buoyed stronger

profits in its food arm, which saw sales increase by 8.7% to £9 billion over the year. M&S revenues grew by 6% to £13.8 billion as a whole for the year, as fashion, home and beauty sales

grew by 3.5%. Article continues below M&S, which currently has 565 stores, said it plans to have 600 stores by 2028, comprising 420 bigger food stores and 180 full clothing, home and

food stores. The organisation has confirmed that the plan is still on track despite the recent disruption.