Hackers taunt M&S CEO with abusive ransom note after cyberattack

Hackers have sent an abusive ransom letter to the CEO of Marks & Spencer, gloating about their actions and demanding a ransom payment.

 

Recently, the BBC reported that on April 23, M&S CEO Stuart Machin received a ransom letter from the DragonForce Hacker group, sent via a compromised employee email account. This confirms that the British retailer indeed suffered a ransomware attack, something the company has yet to publicly acknowledge.

 

“We have marched the ways from China all the way to the UK and have mercilessly raped your company and encrypted all the servers. The dragon wants to speak to you so please head over to our darknet website,” reads the letter seen by the media house.

 

The letter, which was also sent to seven other executives, boasted about deploying ransomware across the M&S internal network, effectively rendering it inoperable. The threat actor further claimed to have stolen sensitive personal data belonging to millions of customers and threatened to leak it.

 

Last month, in a filing with the London Stock Exchange, M&S projected an operating profit loss of up to £300 million for the 2025-2026 financial year.

 

“Since the incident, Food sales have been impacted by reduced availability, although this is already improving. We have also incurred additional waste and logistics costs, due to the need to operate manual processes, impacting profit in the first quarter.

 

“In Fashion, Home & Beauty, online sales and trading profit have been heavily impacted by the necessary decision to pause online shopping, however stores have remained resilient,” M&S said.

 

Furthermore, online disruption caused by the incident is expected to continue until July, after which operations will resume and gradually scale up. As a result, stock management costs are anticipated to rise in the second quarter.

 

“Our current estimate before mitigation is an impact on Group operating profit of around £300m for 2025/26, which will be reduced through management of costs, insurance and other trading actions. It is expected that costs directly relating to the incident will be presented separately as an adjusting item,” M&S added.