Marks & Spencer (M&S) is grappling with the fallout from a significant cyberattack that has severely disrupted its online operations and is projected to reduce the retailer’s operating profits by approximately £300 million.

The breach, which occurred around Easter weekend, was attributed to the hacking group Scattered Spider. As a result, M&S halted all online orders via its website and apps, a disruption expected to continue into July. The attack has notably impacted sales across M&S’s clothing, home, and beauty sectors, which rely heavily on online revenue. In-store operations have also been affected, with reports of empty shelves and the need for manual transaction processing.

Investigations indicate the breach stemmed from social engineering tactics aimed at a third-party contractor, Tata Consulting Services, which manages M&S’s helpdesk. Hackers reportedly used methods such as SIM swapping to gain unauthorized access to internal systems.

The financial impact has been significant. M&S’s market value has dropped by over £1 billion since the attack was disclosed, and the company is seeking to mitigate losses through insurance claims and cost-control measures, hoping to recover about half of the anticipated shortfall.

In response, M&S has prioritized a cautious approach to restoring services. The company is accelerating its technology transformation plan, compressing a previously two-year cybersecurity upgrade into six months. Customers have been advised to continue shopping in physical stores while online services remain offline.

M&S leadership has emphasized safety over speed in the recovery process, promising regular updates as they work to restore full functionality. The incident highlights ongoing cybersecurity risks faced by retailers increasingly reliant on digital platforms.