The aftermath of the 2025 cyber-attack on Marks & Spencer (M&S) continues to reverberate, with the company reporting strong food sales but a significant decline in clothing, homeware, and beauty sales due to ongoing disruptions and consumer confidence issues.
Background and Timeline:
The cyber-attack, attributed to the Scattered Spider hacking group, occurred over the Easter holiday in April 2025. The breach began with a social engineering compromise of a third-party vendor, leading to the deployment of DragonForce ransomware and the shutdown of M&S’s online retail operations for more than six weeks. The company publicly confirmed the cause and scale of the attack in July 2025.
Modus Operandi:
Attackers impersonated an M&S employee to convince a third-party provider to reset access credentials, bypassing technical controls through procedural weaknesses. Once inside, they escalated privileges and deployed ransomware, encrypting key digital infrastructure and halting online shopping, click-and-collect, delivery fulfillment, and returns management. The attack exploited a combination of technical vulnerabilities and human behavior, reflecting a broader trend toward targeting people and processes rather than technology alone.
Victims and Financial Impact:
M&S estimates the financial impact at £300 million (approximately $403 million), wiping out nearly one-third of its annual operating profit. The company’s stock market value dropped by over £1 billion, and weekly losses from clothing and homewares were estimated at £25 million. The disruption led to reduced high street footfall, logistical strain, and customer dissatisfaction, with the full restoration of services expected to take several more weeks.
Investigation and Agencies Involved:
M&S involved the UK’s National Cyber Security Centre (NCSC) and the FBI in the investigation. The company has not confirmed whether customer data was exfiltrated but is conducting ongoing audits. Internal resources remain focused on forensic analysis, infrastructure rebuilding, and reviews of third-party contracts. The company has stated it will not negotiate with attackers and is accelerating its technology transformation plans in response to the incident.
Arrests and Suspects:
While the specific perpetrators have not been apprehended, the attack has been attributed to the Scattered Spider group, a known ransomware-as-a-service affiliate. The incident has prompted increased scrutiny from regulators, partners, and the public, with potential for broader regulatory consequences for supply chain accountability in the retail sector.
Broader Implications and Trends:
The M&S cyber-attack is widely regarded as a turning point in business cybersecurity, demonstrating that even well-established organizations are vulnerable to sophisticated, multi-vector attacks. The incident has accelerated the shift toward behavior-based security, continuous risk assessment, and board-level accountability for cyber risk. It also underscores the importance of robust third-party management, identity verification, and incident response readiness. The retail sector, and businesses more broadly, are being urged to adopt advanced defensive tools and to treat cybersecurity as a material financial risk.