Full Report
UK retail giant Marks & Spencer has confirmed it is managing a cybersecurity incident, following several days of service disruption that affected store operations and customer experiences. The company disclosed the Marks & Spencer data breach incident in a filing to the London Stock Exchange on April 22, 2025, and reassured customers that while some operations were temporarily adjusted, its stores remain open and both its website and app are currently functional. The Marks & Spencer data breach incident has raised concerns about cybersecurity preparedness in large retail chains. According to the official filing released at 14:14 BST on Monday, Marks & Spencer took quick action after detecting the breach. The company stated: “As soon as we became aware of the incident, it was necessary to make some minor, temporary changes to our store operations to protect customers and the business, and we are sorry for any inconvenience experienced.” Details of the Marks & Spencer Data Breach While the full extent of the cyberattack on Marks & Spencer remains unclear, the retailer emphasized that it has engaged external cybersecurity experts to assist with the investigation and mitigation efforts. Additionally, the incident has been reported to the National Cyber Security Centre (NCSC) and relevant data protection authorities. So far, Marks & Spencer has not confirmed whether customer data has been compromised, a key detail eagerly awaited by both the public and cybersecurity observers. The company has promised further updates should the situation evolve. This data breach at Marks & Spencer has already impacted some in-store services, including its popular Click & Collect function. On the social media platform X (formerly Twitter), customers have expressed frustration with ongoing technical issues. Social Media Users Share New Stories [caption id="attachment_102193" align="alignnone" width="598"] Marks & Spencer on X (Source: X)[/caption] One user, @JohnWH79, posted on April 19: “Do companies even have business continuity plans anymore? Computers go down and even the basics seem impossible. ‘Sorry sir, finding parcels is what the computer does.’” In response, Marks & Spencer’s official X account acknowledged the disruption and issued an apology: “... is now back up and running. Please accept my sincere apologies that at the time you visited your local store, this issue directly affected you, as well as other customers.” However, further comments from customers suggest the issues are not entirely resolved. As of April 22, Click & Collect services in some stores remain down, prompting more concern. M&S replied to one such comment: “We are working hard to resolve some technical issues in our stores, and we are not able to process click and collect orders in some stores at this time. Apologies for the inconvenience – Amelia.” Customers also questioned the absence of basic contingency plans. One post asked why no manual system, like “paper and pen,” was in place during the downtime. Conclusion The Marks & Spencer cyberattack comes at a pivotal moment for the retailer, with its financial year having ended on March 29, 2025, and full-year results set for release on May 21. As analysts closely monitor the potential impact on customer confidence and company performance, Marks & Spencer has yet to issue further statements beyond official filings and social media responses. While representatives such as Fraser Ramzan and the Corporate Press Office remain available for inquiries, no new information has emerged regarding the nature or scope of the data breach at Marks & Spencer. This is an ongoing story, and The Cyber Express will be closely monitoring the situation, and we’ll update this post once we have more information on the attack.
Analysis Summary
# Incident Report: Marks & Spencer Retail Service Disruption and Data Breach
## Executive Summary
Marks & Spencer (M&S) confirmed a cybersecurity incident that led to significant operational disruptions across its retail services, affecting capabilities like Click & Collect for several days leading up to April 23, 2025. While the exact nature and scope of the data breach have not been fully disclosed by M&S, the incident severely impacted customer transactions and highlighted a lack of manual contingency planning. Response efforts included public acknowledgments and attempts to restore system functionality.
## Incident Details
- Discovery Date: Leading up to and including April 23, 2025 (Disruptions reported over several days prior to this date)
- Incident Date: Ongoing prior to April 23, 2025
- Affected Organization: Marks & Spencer (M&S)
- Sector: Retail
- Geography: UK (Implied, given the nature of M&S operations and service issues)
## Timeline of Events
### Initial Access
- Date/Time: Unknown (Prior to service disruptions noted around April 23, 2025)
- Vector: Not publicly disclosed; the event is confirmed as a "cyberattack" resulting in a "data breach."
- Details: The attack resulted in widespread technical issues preventing basic in-store functions, such as processing transactions and executing Click & Collect services.
### Lateral Movement
- Details: No specific details on lateral movement were provided in the source material.
### Data Exfiltration/Impact
- Details: A data breach occurred, but the type or volume of stolen data remains officially undisclosed. The immediate impact was significant disruption to retail services, including online order fulfillment (Click & Collect) and potentially in-store POS/inventory systems.
### Detection & Response
- Details: The incident was detected through customer complaints regarding service outages. M&S officially acknowledged the disruption via its social media channels starting around April 22, 2025, apologizing for the inability to process Click & Collect orders and stating that systems were being worked on to resolve the issues.
## Attack Methodology
- Initial Access: Unknown (Presumed infiltration leading to system compromise)
- Persistence: Unknown
- Privilege Escalation: Unknown
- Defense Evasion: Unknown
- Credential Access: Unknown
- Discovery: Unknown
- Lateral Movement: Unknown
- Collection: Unknown
- Exfiltration: Unknown (Confirmed data breach, but details withheld)
- Impact: Disruption of key retail operations (e.g., Click & Collect), leading to a poor customer experience.
## Impact Assessment
- Financial: Potential impact on customer confidence and upcoming financial results (set for May 21, 2025). Direct costs are unknown.
- Data Breach: Confirmed data breach; scope and specific data types (customer PII, payment data, etc.) are not specified in the summary.
- Operational: Severe disruption to key retail services, including Click & Collect functionality in some stores persisting even after initial public acknowledgments (as of April 22).
- Reputational: Negative impact on customer confidence due to system failures and the absence of perceived manual contingency plans.
## Indicators of Compromise
- Network indicators: None provided (defanged).
- File indicators: None provided.
- Behavioral indicators: System outages preventing standard operational tasks (e.g., transaction processing, parcel tracking).
## Response Actions
- Containment measures: Not detailed, but was focused on restoring core retail services.
- Eradication steps: Not detailed.
- Recovery actions: Public acknowledgment and communication via social media; working to bring affected systems back online.
## Lessons Learned
- Inadequate Contingency Planning: A significant lack of manual contingency plans (e.g., "paper and pen" systems) was evident during system downtime, exacerbating operational impact.
- Communication Timing: While M&S eventually acknowledged the issue, disruptions occurred over several days before official confirmation.
## Recommendations
- Develop and rigorously test robust manual/analog contingency plans for all critical customer-facing systems (POS, inventory management, order fulfillment) to ensure service continuity during cyber events.
- Immediately investigate the root cause of the confirmed data breach to accurately assess the scope of exfiltrated data and notify potentially affected parties as required.
- Review and enhance detection capabilities targeting the specific initial access vector used to prevent recurrence.