M&S cyber-attack disruption to last until July

Marks & Spencer has said its online services will continue to be disrupted until July due to last month's cyber-attack.

Customers have been unable to order online for almost a month.

"We expect online disruption to continue throughout June and into July as we restart, then ramp up operations," the retailer said.

It estimates that the cyber-attack will reduce profits for the current year by around £300m - which is more than analysts had expected and the equivalent of a 30% hit to profits.

"Over the last few weeks, we have been managing a highly sophisticated and targeted cyber-attack, which has led to a limited period of disruption," said M&S chief executive Stuart Machin.

The cyber-attack took place over the Easter weekend, initially affecting click-and-collect and contactless payments. A few days later M&S put a banner on its website apologising that online ordering was not available.

The ransomware attack is thought to have been the work of a loose collective of online actors known as Scattered Spider, using illicit tools from the cyber-crime service DragonForce.

The same group is believed to have been behind attacks on the Co-op and Harrods, but it was M&S, a long-standing mainstay of the UK High Street, that suffered the biggest impact.

"This incident is a bump in the road, and we will come out of this in better shape, and continue our plan to reshape M&S for customers, colleagues and shareholders," Mr Machin said.

• Police investigation into UK retail hacks focuses on English-speaking youths

M&S is now three years into a turnaround strategy, started when Mr Machin joined as chief executive in 2022.

It involves updating in-store ranges and the chain's property portfolio, with digital technology and back-office systems also set to be overhauled.

The strategy had put M&S in it "best financial health for nearly 30 years" Mr Machin said, delivering results for the financial year ending in March just before the hack disrupted services at the end of April.

M&S reported profit before tax and adjusting items had risen 22% to £875m, while sales rose 6.1%.

Mr Machin said the cyber-attack had highlighted "new and innovative ways of working".

"If anything, the incident allows us to accelerate the pace of change as we draw a line and move on," Mr Machin added.

But it will also weigh on M&S's profits for the current year, with food hit sales by reduced availability, the company said.

In fashion home and beauty, online sales were lost due to the pause in online ordering.

Meanwhile, additional waste and logistic costs, including needing to use manual processes, have affected profit.

While insurance is expected to cover perhaps a third of the bill, there could be further charges to consider including fines for the data loss, litigation, and future-proofing the business from new attacks.