Published by Global Banking & Finance Review®
Posted on July 8, 2025
3 min readLast updated: January 23, 2026
Add as preferred source on GoogleM&S chairman urges UK firms to report major cyberattacks, citing recent unreported incidents. M&S faced a costly cyberattack, highlighting the need for improved cybersecurity practices.
By James Davey
LONDON (Reuters) -British businesses should be legally required to report material cyberattacks to the authorities, the chairman of retailer Marks & Spencer said on Tuesday, claiming two recent major attacks on large UK firms had gone unreported.
Giving evidence to lawmakers on parliament's Business and Trade Committee on the April cyberattack which forced M&S to suspend online shopping for nearly seven weeks, Archie Norman said the group had learnt that "quite a large number" of serious cyberattacks never get reported to the National Cyber Security Centre (NCSC).
"In fact we have reason to believe there've been two major cyberattacks on large British companies in the last four months which have gone unreported," he said.
Norman said that meant there was "a big deficit" in knowledge in the cybersecurity space.
"So I don't think it would be regulatory overkill to say if you have a material attack ... for companies of a certain size you are required within a time limit to report those to the NCSC."
Norman declined to say if M&S had paid any ransom but said that subject was "fully shared" with the National Crime Agency and other authorities.
He said "loosely aligned parties" worked together on the M&S cyberattack.
"We believe in this case there was the instigator of the attack and then, believed to be DragonForce, who were a ransomware operation based, we believe, in Asia."
A hacking collective known as Scattered Spider that deploys ransomware from DragonForce has previously been blamed in the media for the attack.
"When this happens you don't know who the attacker is, and in fact they never send you a letter signed Scattered Spider, that doesn't happen," said Norman.
He said M&S didn't hear from the threat actor for about a week after it initially penetrated its systems on April 17 through a "social engineering" operation.
In May, M&S said the attack would cost it about 300 million pounds ($409 million) in lost operating profit.
Norman said M&S was fortunate in having doubled its cyberattack insurance cover last year, though its claim could take 18 months to process.
M&S resumed taking online orders for clothing lines on June 10 after a 46-day suspension but is yet to restore click and collect services.
Last week, M&S CEO Stuart Machin told investors the group would be over the worst of the fallout from the attack by August.
Nick Folland, M&S' General Counsel, told the lawmakers a major lesson from the crisis for businesses generally was to make sure they can operate with pen and paper.
"That's what you need to be able to do for a period of time whilst all of your systems are down," he said.
(Reporting by James Davey, Editing by Sachin Ravikumar and Susan Fenton)
M&S chairman Archie Norman suggests that UK businesses should be legally required to report material cyberattacks to the authorities.
The April cyberattack forced M&S to suspend online shopping for nearly seven weeks and is estimated to cost the company about 300 million pounds in lost operating profit.
Norman believes that mandatory reporting would address the 'big deficit' in knowledge within the cybersecurity space, ensuring better awareness and response to such incidents.
M&S General Counsel Nick Folland emphasized the importance of being able to operate with pen and paper during system downtimes, highlighting the need for business continuity planning.
M&S resumed taking online orders for clothing lines on June 10 after a 46-day suspension but has yet to restore its click and collect services.
Explore more articles in the Headlines category
