This is not just any cyberattack. This is a cyberattack that has resulted in more than a week’s worth of disruption and dramatic share price losses for one of Britain’s most popular stocks.
Shares in Marks & Spencer (M&S) plunged 6.9% over the seven days to 29 April, and around £700 million has been wiped off the company’s market value as investors weigh up the impact of reputational damage and lost sales.
The group behind the cyberattack has not been confirmed, but reports suggest it could be linked to a hacking group known as Scattered Spider. The group is thought to include British and American teenagers.
Try 6 free issues of MoneyWeek today
Get unparalleled financial insight, analysis and expert opinion you can profit from.
Start your trial
Sign up for MoneyWeek’s free twice-daily newsletter.
Join more than 165,000 subscribers and keep yourself informed with latest financial news, insights and expert analysis to help you understand what really matters when it comes to your finances.
Join more than 165,000 subscribers and keep yourself informed with latest financial news, insights and expert analysis to help you understand what really matters when it comes to your finances.
The impact on Marks & Spencer’s operations has been significant. Contactless payments were temporarily out of action in stores, and online orders and click-and-collect services remain suspended.
Latest Videos FromMoneyWeek
There have also been reports of empty shelves in some food stores, after the retailer was forced to take some of its food-related systems offline.
It will be disheartening for the company’s management team, which has put a huge amount of energy into turning M&S around in recent years.
After facing relegation from the FTSE 100 in 2019 after a period of disappointing sales, the retailer returned to the UK’s main stock market index in 2023. At the time of writing, its share price has more than quadrupled since late 2022.
“Marks and Spencer’s recent run of success has been partly down to how efficient it has been at managing its multi-channel operations with click and collect services particularly popular,” said Susannah Streeter, head of money and markets at Hargreaves Lansdown.
This will make the recent cyberattack even more of a bitter pill to swallow. The company has been closing lots of shops in recent years to focus on smaller food stores where customers can pick up “click and collect” orders. The cyberattack has turned this model upside down.
It couldn’t have come at a worse time either. “Fashion sales are likely to take a big hit as the attack has come during the spell of warm weather when summer ranges would ordinarily be piling up in virtual baskets,” Streeter said.
The disruption began over the Easter weekend, and now threatens to spill into the early May bank holiday too. Both would usually be a big time for customers to hit the shops or fill up their online baskets with new clothes for the warmer weather.
What does the M&S cyberattack mean for investors?
Other retailers have been hit by cyberattacks in the past, such as JD Sports; the incident in 2023 leaked 10 million customers’ data. The nature of this attack was different to the one affecting M&S, though. Although data leaks can cause significant reputational damage, operations were not halted.
A ransomware attack on supply-chain software provider Blue Yonder also caused disruption for several retailers in November 2024, including Morrisons and Sainsbury’s, which use the software for logistics and inventory management.
The scale of the M&S incident is significantly larger. One of the most harmful aspects is that online orders have been completely halted.
The Telegraph reports that more than three million orders are placed online at M&S every month, of which 2.2 million are click-and-collect orders. One expert, Nicholas Found from Retail Economics, told the paper the disruption was likely to be costing the company “seven figures per day”.
Beyond the short-term hit, investors will want to understand what M&S is doing to protect itself from similar incidents in the future.
“While other retailers have not been immune to IT breaches, the depth of Marks and Spencer’s problems in resolving the issue are worrying, and it may take some time to win back warier shoppers,” Streeter said.
Despite this, the share price has gradually started to regain some of its losses over the past two days, even amidst the ongoing disruption. Between market open on Monday and market close on Wednesday, the stock rose around 1%.
This suggests investors are “confident M&S can sort out disruption to its systems… and that too much bad news has been priced into the stock,” said Russ Mould, investment director at AJ Bell.
“The fact the disruption is still unresolved would suggest that management are being incredibly thorough behind the scenes to ensure everything is secure before switching online platforms back on,” he added.
