How far has the cyberattack knocked Marks & Spencer off course?

The month of April “started really strongly, continuing the momentum from last year”, M&S’s chief told the press this week.

“And then, over the Easter bank holiday, I got a call from one of the team to say they’d spotted suspicious activity.”

It is a moment Stuart Machin is unlikely to forget in a hurry – the start of the nightmare cyberattack that has wrought havoc on M&S’s operations. Hackers took over systems after tricking log-in details out of a third-party contractor.

M&S’s annual results on Wednesday brought the clearest picture yet of how far it has been knocked off course.

So, how bad is the damage? And what does the road to recovery look like now?

The lost sales

Food sales were “impacted by a few weeks of reduced availability, although we’re now back on track,” says Machin.

The same cannot be said for clothing & home, where online sales remain suspended.

Given online accounts for about a third of clothing and home sales, that will “impact sales and profit in the first half”, Machin admits. In-store trading is also “a bit softer than we would like”, he revealed – not helped by the online stock checker being down.

GlobalData senior retail analyst Eleanor Simpson-Gould warns: “Shoppers will turn to John Lewis & Partners and Next’s online platforms, despite efforts to shift customers to its physical locations.”

Machin acknowledges: “The first thing customers are asking is when is online up again. The second is what’s in my store.”

On the first point, customers now have an answer. M&S forecasts online disruption will last until July.

The rebuild

That’s because “turning this system back on is quite complex”, says Machin.

“We’ve been cleansing our whole digital estate. We have over 600 applications and ­thousands of servers.

“What the team have been doing is working through the ones we want to remove or close and also how we modernise.”

M&S’s website went down completely for several hours on Wednesday evening as it made overnight updates.

It’s a sign of M&S accelerating its upgrade to legacy technology systems. When the programme kicked off in 2024, it was designed to run over two years. The aim is to now do that work in six months.

“We had to scope it out over a couple of years because it would disrupt the business,” says Machin. “Now we’re disrupted, we’ve cracked on.”

The full costs

M&S estimates group operating profit will be hit to the tune of £300m for this financial year, says Machin.

However, he stresses this will be reduced “through managing costs, trading actions and insurance recovery”.

But there is the issue of a financial penalty, given hackers have accessed customer data.

AJ Bell investment analyst Dan Coatsworth warns: “There’s still a big unknown regarding fines from the Information Commissioner’s Office. The maximum fine is £17.5m or 4% of global annual turnover, whichever is higher. M&S has just reported £13.8bn, so 4% of that is £552m.”

Read more:

• M&S cyberattack ‘nothing to do with underinvestment’ in tech, says chief

• Lawyers eyeing M&S cyberattack slammed by campaign against ‘predatory litigation’

• M&S cyberattack to cost £300m as disruption continues until July

• ‘Ambulance-chasing’ lawyers no better than the M&S hackers

Another unknown is litigation. A law firm in Scotland this week vowed to launch a class action lawsuit, despite the breach not including card payment details.

“We have been approached by hundreds of Scottish victims of the M&S data breach scandal who have suffered distress, upset and anguish,” says Patrick McGuire, senior partner at Thompsons Solicitors.

M&S says it has “not received any claims”.

The recovery time

Machin is “confident we will enter the second half of the year [starting October] with a strong customer proposition, returning to the performance we were delivering prior to the incident”.

AJ Bell’s Coatsworth seems less sure. “The fact online operations might not be back to full power until later in the summer means the company still cannot achieve full earnings potential for some time to come,” he says.

“Now comes the hard part of trying win back customers’ trust,” Coatsworth adds.

But M&S has a history of facing down tough challenges and coming out stronger.

“Machin will be hoping people say the same thing in a year’s time,” says Coatsworth. “He just needs to stabilise the ship in the interim.”