Cyber attack to cost M&S £300 million, operations disrupted through July

Marks & Spencer said it has estimated a £300m profit loss for the current financial year resulting from the significant data security incident it experienced last month.

 

Last month, in a filing with the London Stock Exchange, British multinational retailer, Marks and Spencer said on April 22, it suffered a significant cyber security incident and immediately launched an investigation to determine the nature and scope of the same.

 

The investigation revealed that the sensitive personal information of M&S customers was compromised during the incident. The compromised data included names, email addresses, addresses, telephone numbers, dates of birth, online order history, household information and ‘masked’ payment card details used for online purchases.

 

M&S, however, assured its customers that usable payment or card details and account passwords weren’t affected during the incident.

 

In its most recent filing with the LSE on May 21, M&S projected an operating profit loss of up to £300 million for the 2025-2026 financial year.

 

“Since the incident, Food sales have been impacted by reduced availability, although this is already improving. We have also incurred additional waste and logistics costs, due to the need to operate manual processes, impacting profit in the first quarter.

 

“In Fashion, Home & Beauty, online sales and trading profit have been heavily impacted by the necessary decision to pause online shopping, however stores have remained resilient,” M&S said.

 

Furthermore, online disruption caused by the incident is expected to continue until July, after which operations will resume and gradually scale up. As a result, stock management costs are anticipated to rise in the second quarter.

 

“Our current estimate before mitigation is an impact on Group operating profit of around £300m for 2025/26, which will be reduced through management of costs, insurance and other trading actions. It is expected that costs directly relating to the incident will be presented separately as an adjusting item,” M&S added.