M&S results: cyber attack to cost £300 million in profit

Marks and Spencer (M&S) has announced an earnings and revenue beat in its full year results this morning, under a cloud of pessimism following the cyber attack that has crippled the retail giant over recent weeks.

One of the most popular stocks in the UK, M&S (LON:MKS) is also a household name among the FTSE 100. But, it is in a challenging position.

M&S shares have fallen over 10% over the past month, as the cyber attack – which first started impacting services over the Easter weekend – brought its services to a standstill.

Subscribe to MoneyWeek

Subscribe to MoneyWeek today and get your first six magazine issues absolutely FREE

Get 6 issues free

Sign up to Money Morning

Don't miss the latest investment and personal finances news, market analysis, plus money-saving tips with our free twice-daily newsletter

Don't miss the latest investment and personal finances news, market analysis, plus money-saving tips with our free twice-daily newsletter

Sign up

“All eyes will be on Marks and Spencer’s update given the cyber attack, which has caused chaos at the company,” said Susannah Streeter, head of money and markets, Hargreaves Lansdown ahead of the announcement.

As of 20 May, M&S is still not taking online orders. Bank of America estimates that M&S has lost £40 million in sales every week since the attack began. This morning, M&S confirmed an estimated £300 million hit to its FY 2025/26 operating profit as a result of the attack.

Shares in M&S opened 2.3% lower on 21 May, following the results announcement, than their close the previous day. That reflects investor pessimism around the profit warning, though it could also be influenced by simultaneous news that UK inflation jumped to 3.5% in April.

Thanks largely to the cyber attack, M&S shares are down 4.9% so far this year. M&S’ share price gained 2.1% in the five days running up to its results announcement.

However, that operating profit figure, as well as the news that online operations are unlikely to resume in full before July, appears to have dented investor confidence.

M&S results: what was announced

The financial results are “likely to be overshadowed by the cyber attack that M&S is under,” wrote Jonathan Pritchard, retail analyst at Peel Hunt, in a research note seen by MoneyWeek.

“Absent the cyber attack, we would have been of the view that a strong FY25 print would have been accompanied by… news of a strong April and May so far,” Pritchard added.

Pritchard’s preview was accurate. Analysts polled by London Stock Exchange Group had yielded consensus estimates of 28.99p earnings per share (EPS) on revenue of £13.76 billion.

M&S beat expectations on both counts, posting adjusted EPS of 31.9p and revenue of £13.91 billion.

However, these results only cover the year to March, and as such pre-date the cyber attack. The results confirmed that there are still weeks, and possibly months, of disruption to come as a result, and that its 2025/26 financial year is going to be heavily impacted.

“FY26 is pretty much a write-off,” wrote Pritchard, before the results. “It may be that the runes for FY27 are for less growth than initially thought.”

M&S cyber attack update

The headline figure as far as investors are concerned, though, is the £300 million dent in operating profit that M&S anticipates this financial year as a result of the cyber attack.

“It has been challenging, but it is a moment in time, and we are now focused on recovery, with the aim of exiting this period a much stronger business,” said M&S CEO Stuart Machin. “There is no change to our strategy and our longer-term plans to reshape M&S for growth and, if anything, the incident allows us to accelerate the pace of change as we draw a line and move on.”

M&S said that the £300 million hit to FY 2025/26 operating profits “will be reduced through management of costs, insurance and other trading actions.” Online disruption is expected to last throughout June and into July, whereafter the retailer is looking to restart and ramp up its operations.

It added that this will add to its stock management costs during the second quarter.

The BBC reported on 17 May that Dragonforce, the hacker group behind the M&S cyber attack, is believed to have gained entry to its systems via a third party. M&S told the BBC that “our stores have remained open and availability is now in a much more normal place with stores well stocked this weekend”.

M&S has previously confirmed that some customers’ personal information was compromised in the attack. This could include name, date of birth, telephone number, home address, household information, email address and online order history.

Any payment card information accessed will not be usable, as M&S thankfully does not store full card information.

However, anyone with an M&S account is advised to change their password as soon as possible, and to make this password different to those used in any other site.