Cyber Incident Victim: Marks & Spencer
Timeline
Summary
Marks & Spencer reported a profit downturn linked to the aftermath of a cyber‑attack that disrupted its supply chains and ecommerce operations, with statutory profit before tax falling 28.8% to £364.6m while total revenue rose 24.8% to about £17.4bn, a gain largely attributable to the Ocado Retail consolidation. Excluding Ocado, underlying sales grew only 1.9%, reflecting a year of two halves where the attack caused significant operational setbacks in the first half and a partial recovery in the second, leading to a 7% rise in food sales but a 7.7% drop in fashion, home and beauty sales and reduced adjusted operating profit from £491.8m to £444.5m due to wastage and markdowns, and prompting staff bonus cuts as the firm invests in supply chain modernisation, technology upgrades and store rotations to rebuild.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 0 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Marks & Spencer reported a profit downturn of 23.8% for the financial year ending 28 March 2026, attributing the decline to the ongoing fallout from a cyber‑attack that occurred the previous April. Statutory profit before tax fell 28.8% to £364.6 million, while total revenues rose 24.8% year on year to approximately £17.4 billion, a increase largely driven by the consolidation of Ocado Retail into the group accounts. Excluding Ocado, underlying sales growth was modest at 1.9%, indicating that the headline revenue improvement overstated the core business performance. The company described the year as a “year of two halves,” noting that the cyber‑attack caused significant operational disruption in the first half of the fiscal year before a return to sales and profit growth in the second half. The attack is estimated to have erased roughly one‑third of Marks & Spencer’s profits for the period.
In the first half, the cyber‑attack severely disrupted supply chains and ecommerce operations, leading to wastage and stock markdowns that reduced adjusted operating profit to £444.5 million, down from £491.8 million in the prior year. Food sales nevertheless increased by 7% as customer numbers grew, reflecting continued demand for M&S Food despite the broader challenges. Fashion, Home & Beauty sales declined by 7.7%, a drop attributed to the temporary pause in online trading and restricted systems access during the attack’s aftermath. The Times reported that staff bonuses were cut for the year as the company allocated resources to rebuild after the incident. These operational impacts directly contributed to the profit contraction reported for the financial year.
In response, Marks & Spencer outlined plans for 2026 centred on growth and resilience, including investment in supply chain modernisation, technology transformation, and store rotation. The company aims to double its online fashion business by expanding supply chain capacity, open new stores, and implement structural cost‑reduction measures to offset rising colleague pay inflation and government tax levies. CEO Stuart Machin emphasized that food remained a standout performer and expressed confidence in the company’s ability to protect its brand while modernising other aspects of the business. These statements reflect the steps Marks & Spencer is taking to recover from the cyber‑attack and position itself for future performance.