Marks & Spencer Website Resumes Online Orders Six Weeks After Cyber-Attack
The online shopping website of Marks & Spencer, a leading British retailer, has reopened six weeks after a cyber-attack forced the company to halt online orders. According to a statement on its website, M&S said customers "can now place online orders with standard delivery to England, Scotland and Wales", while deliveries to Northern Ireland will resume in the coming weeks.
In an update on its website, M&S confirmed that it would also resume click and collect, next-day and nominated-day delivery and international ordering in the coming weeks. John Lyttle, the retailer’s managing director for fashion, home and beauty, said in a social media post: "We are bringing back online shopping this week. A selection of our best-selling fashion ranges will be available for home delivery to England, Scotland and Wales from today. More of our fashion, home and beauty products will be added every day and we will resume deliveries to Northern Ireland and click and collect in the coming weeks."
The cyber-attack, which is believed to have been carried out by a hacking collective known as Scattered Spider, occurred over the Easter weekend and resulted in the theft of personal data relating to thousands of customers, including names, addresses, dates of birth and order histories. The company has estimated that the hack could cost it up to £300m in profits this year, although about half of that is expected to be offset by insurance and other measures.
M&S has confirmed that shoppers have been able to browse online and shop in its physical stores using cash or cards for most of the period since the hack. However, stocks of food and clothing in stores have also been affected, resulting in lost sales during a busy period for retailers. The company’s shares rose by more than 3% in early trading and were among the top risers on the FTSE 100.
According to The Guardian, which first reported the story, M&S boss Stuart Machin has said he expects the retailer to recover "at pace" helped by bringing forward investment in its IT systems and website as part of the systems rebuild forced on it by the hackers. Machin told the Mail on Sunday that he "went into shock" when he was first told late at night about the ransomware attack. However, he insisted that it did not cause a "crisis" but was more of "a setback, a bump in the road" for M&S.
The attack on M&S is one of several high-profile cyber-attacks to hit British retailers in recent weeks. The Co-op and Harrods have also reported cyber-attacks, while sportswear brand Adidas and lingerie group Victoria’s Secret have also been targeted. As The Guardian previously reported, M&S is expected to speed up efforts to overhaul its digital infrastructure, which was originally due to take three years but may now take "a year and a half".
The company’s managing director for fashion, home and beauty, John Lyttle, has confirmed that M&S is working hard to resume services as soon as possible. The news that online orders have resumed will come as a relief to customers who have been unable to shop online with the retailer for six weeks. As The Guardian previously reported, M&S is estimated to have been losing about £25m in online clothing and homewares sales a week after it was forced to stop taking orders on its website.
Original reporting by The Guardian can be found here: https://www.theguardian.com/business/2025/jun/10/m-s-marks-and-spencer-website-online-orders-cyber-attack.
