Story perspectives

Marks & Spencer Cyberattack: £300 Million Loss, Empty Shelves

5/22/2025

26 4

Summary

Story summary

Marks & Spencer faced a cyberattack from Scattered Spider, projected to cost £300 million in profits and disrupt operations until July.
The attack exploited vulnerabilities through a third-party supplier, resulting in ransomware deployment and operational chaos.
M&S has shifted to manual stock management, leading to empty shelves and customer dissatisfaction.
The company expects to recover £100 million via insurance, with CEO Stuart Machin focusing on recovery and growth.
The incident caused a market capitalization loss exceeding £1 billion, with shares declining 13% since the attack.

History

Historical Context

Marks & Spencer's recent cyberattack mirrors the 2021 Colonial Pipeline incident, where ransomware crippled vital infrastructure. Both events highlight vulnerabilities in supply chains and the growing threat from sophisticated hacking groups. These incidents underscore the urgent need for robust cybersecurity measures in today's interconnected economy.

1 of 2

Story summary

Marks & Spencer faced a cyberattack from Scattered Spider, projected to cost £300 million in profits and disrupt operations until July.
The attack exploited vulnerabilities through a third-party supplier, resulting in ransomware deployment and operational chaos.
M&S has shifted to manual stock management, leading to empty shelves and customer dissatisfaction.
The company expects to recover £100 million via insurance, with CEO Stuart Machin focusing on recovery and growth.
The incident caused a market capitalization loss exceeding £1 billion, with shares declining 13% since the attack.

1 / 2