The M&S cyber attack continues to shape the retailer’s performance more than 18 months after it disrupted online and in-store services. On 4 November 2026, Marks & Spencer reported that first-half profit had rebounded from the cyber-hit previous year, although weaker clothing performance continued to slow the wider recovery.
The update marks an important stage in M&S’s recovery from an incident that interrupted digital sales, forced parts of the business onto manual processes and exposed some customer information. It also provides a clearer picture of the attack’s lasting operational and financial consequences.
M&S cyber attack recovery reaches new stage
M&S said its first-half profit had recovered from the comparable period affected by the incident. However, the company’s clothing operation remained behind expectations, particularly when performance was assessed against two-year comparisons.
This means the latest results are not a simple return to normal. They show that the direct cyber disruption has receded, while the commercial effects of interrupted trading and subsequent operational changes are still interacting with challenges in a major product category.
The financial recovery follows significant costs disclosed in earlier results. On 20 May 2026, M&S reported 131.3 million pounds in incident-related costs and 100 million pounds of insurance income within adjusted profit. These figures illustrate both the scale of the response and the extent to which insurance reduced, but did not eliminate, the financial impact.
M&S’s reporting also described the use of manual processes and controls during the first half of its financial year. Automated processes were restored in stages during the second half, indicating that the M&S cyber attack affected more than the retailer’s public website.
How the M&S cyber attack unfolded
Initial disclosure and protective action
M&S first disclosed the incident in a regulatory announcement at 15:14 BST on 22 April 2025. It said it had been managing a cyber incident for the previous few days and had brought in external cyber security specialists.
The retailer also notified relevant data protection supervisory authorities and the National Cyber Security Centre. At that point, its stores, website and app remained operational, but protective changes had already been made to store processes.
The disruption escalated on 25 April 2025. M&S paused new orders through its UK and Ireland websites and mobile apps, although customers could still browse products online. Reports also identified problems affecting contactless payments, Click and Collect, gift card redemption and self-service return kiosks.
Some systems were disabled as a precaution while investigators examined the intrusion. Moving activities offline and relying on manual workarounds helped contain risk, but it also reduced the retailer’s ability to process normal volumes of digital and store transactions.
Customer information was taken
On 13 May 2025, M&S confirmed that an attacker had accessed some customer personal data. Potentially affected information included contact details, dates of birth, online order histories, household information and masked payment card details.
The company said the stolen information did not include usable card or payment details. It also said account passwords were not taken. Nevertheless, customers were prompted to reset their passwords as a precaution and were warned to remain alert for phishing attempts that might use exposed personal details to appear credible.
No public technical indicators of compromise, such as malicious IP addresses, file hashes, domains or malware names, have been released by M&S or the authorities. The company has also not identified a vulnerable product or software version that provided the entry point.
Online orders return after 46 days
Online clothing orders resumed on 11 June 2025 after a 46-day interruption. Services were reintroduced progressively rather than restored all at once, reflecting the need to validate systems and rebuild automated operations safely.
The affected services included:
- Online ordering through the UK and Ireland websites and mobile apps.
- Contactless payment services in stores.
- Click and Collect ordering and fulfilment.
- Gift card redemption and self-service return kiosks.
- Internal automated processes that were temporarily replaced by manual controls.
The breadth of disruption distinguishes the M&S cyber attack from a short website outage. It crossed digital commerce, payment processes, store services, order fulfilment and internal operations, extending its effect across both customer-facing and back-office activities.
Attack attribution remains unconfirmed
M&S has described the event as a cyber incident involving unauthorised access to customer information, but it has not publicly named the attacker or disclosed the malware and techniques involved. There is therefore no confirmed public attribution to a particular criminal group.
Some technology reports, citing unnamed sources, have linked the incident to Scattered Spider. Other commentary has suggested a possible connection to DragonForce. Neither claim has been confirmed by M&S, so both should be treated as unverified rather than established findings.
Claims that a particular supplier, third party or software product was the initial route into the company also remain unconfirmed. No public proof of concept is relevant because this was a targeted compromise of M&S systems, not the disclosure of a specific software vulnerability that other organisations can patch.
The confirmed exploitation status is clear: attackers gained access to some personal data, and the incident caused weeks of disruption to active business systems. However, the absence of published indicators means other organisations cannot search for a definitive set of M&S-specific artefacts.
Financial impact and the path to recovery
M&S’s half-year results on 5 November 2025 provided an early formal view of incident-related expenditure and insurance proceeds. Its full-year results on 20 May 2026 then quantified the costs at 131.3 million pounds and recognised 100 million pounds in insurance income within adjusted profit.
The 4 November 2026 update now shows profit rebounding against the heavily affected prior-year period. Clothing remains the limiting factor, however, demonstrating that recovery from a major attack can continue after systems and online ordering have returned.
CyPro’s earlier analysis of the profit impact examined the initial pressure on M&S’s results. The latest reporting completes more of the picture by showing stronger profitability alongside an uneven commercial recovery.
What UK organisations should take from the incident
The M&S cyber attack shows why continuity plans must cover dependencies between e-commerce, payments, store systems and fulfilment. Disabling one service for containment can create operational pressure elsewhere, particularly when automated processes must be replaced manually.
Organisations with similar digital sales models should prioritise a small number of event-specific actions:
- Test whether essential orders, returns and customer support can continue when core platforms are offline.
- Document how contactless payments, collection services and fulfilment will be suspended or isolated safely.
- Prepare customer notices that clearly distinguish exposed personal data from unaffected passwords and payment details.
- Confirm that insurance terms, incident costs and recovery expenditure can be recorded accurately from the start.
M&S’s profit rebound is a positive milestone, but the clothing slowdown shows why cyber recovery should be measured through commercial performance as well as technical restoration. Systems may return in weeks, while operational and financial effects remain visible for much longer.
Originally reported by Euronext Markets: Real-time Stock Market Data.
