M&S' $400 million cyberattack upheaval to linger into July

By James Davey and Paul Sandle

LONDON (Reuters) -A "highly sophisticated and targeted" cyberattack will cost Marks & Spencer about 300 million pounds ($403 million) in lost operating profit, and disruption to online services is likely until July, the British retailer said on Wednesday.

The attack on one of the biggest names on the UK high street forced M&S to resort to pen and paper to move billions of pounds of fresh food, drinks and clothing after it switched off its automated stock systems.

That led to bare food shelves and frustrated customers.

A month on, M&S' large online clothing service remains offline, and the attack has wiped more than a billion pounds off its stock market value.

Chairman Archie Norman said the timing of the attack was unfortunate as M&S, which has been implementing a comprehensive turnaround plan since 2022, had been starting to show its full potential.

"But in business life, just as you think you're onto a good streak, events have a way of putting you on your backside," he said.

M&S, which has 65,000 staff and 565 stores, said the hack would cost about 300 million pounds in lost operating profit in its year to March 2026, although it hopes to halve that impact through insurance, cost control and other actions.

M&S reported 984.5 million pounds in operating profit in the year ended March 29.

The group said online sales and trading profit in its clothing, home and beauty division had been "heavily impacted" by the decision to suspend online shopping, though store sales had "remained resilient".

It said online disruption would continue throughout June and into July as it restarts systems and ramps up operations.

Chief Executive Stuart Machin told reporters he expected about 85% of clothing and home lines to be available online in a few weeks' time.

In food, M&S said it had been hit by reduced availability and higher waste and logistics costs. Food sales had recovered over the last week, however.

Shares in M&S were up 2%, paring losses since the attack to 9%.

"The cyberattack, whilst frustrating, is hopefully a one-off event and today’s update has allowed the market to draw a line under the potential costs," Ian Lance, fund manager at Redwheel, one of M&S' biggest investors, said.

The retailer's operating performance for the year 2024/25 was ahead of analysts' expectations, which Lance said was of more relevance to the company's intrinsic value, as it showed the transformation of the business continued to gather momentum.

'WE DIDN'T LEAVE THE DOOR OPEN'

M&S said it would use the crisis to accelerate improvements to its technology, although it said it had not neglected cyber security.

Machin refused to say whether M&S had paid a ransom.

He said the time between hackers gaining access to its system and detection was short and that M&S had been unlucky "through human error" as the hackers used "social engineering" tactics to trick employees at a third-party contractor.

"We didn't leave the door open. This wasn't anything to do with underinvestment," he said.

British companies and institutions have been hit by increasingly aggressive and regular cyber and ransomware attacks in recent years, with the British Library, a blood testing service and the London Underground all suffering months of disruption.

M&S said last week that some personal customer information had been stolen in the hack.

With hackers having also hit the Co-op and Harrods in Britain, and Google saying last week those responsible were targeting U.S. companies, retailers worldwide are racing to boost defences.

Before the attack, M&S was trading strongly.

Its adjusted pretax profit in 2024/25 was up 22.2%, the highest in over 15 years and comfortably ahead of analysts' average forecast.

Sales increased 6.1% to 13.9 billion pounds, with food sales up 8.7% and clothing, home and beauty sales up 3.5%, as the group gained market share in both divisions.

Machin said UK retailers were supporting each other.

Rivals nevertheless stand to benefit from M&S' problems.

Clothing rival Next, which raised its profit outlook earlier this month after strong first quarter trading, is among those likely to get a trading tailwind, as are John Lewis, Tesco and Sainsbury's, analysts said.

M&S also said on Wednesday it had taken a 248.5 million pound non-cash impairment charge on its investment in the Ocado Retail online shopping joint venture with Ocado Group.

($1 = 0.7443 pounds)

(Reporting by James Davey, editing by Paul Sandle, Kate Holton and Barbara Lewis)