Cyberattack costs UK retailer Marks & Spencer £300 mn
Marks last week revealed that some personal data of its customers had been stolen in a cyberattack that has crippled its online services for weeks.
"In Fashion, Home & Beauty, online sales and trading profit have been heavily impacted by the necessary decision to pause online shopping, however stores have remained resilient," Marks said in a statement.
"We expect online disruption to continue throughout June and into July as we restart, then ramp up operations."
The impact on annual group operating profit is estimated at around £300 million, "which will be reduced through management of costs, insurance and other trading actions", the retailer added.
The news came as Marks on Wednesday reported operating profit before adjusting items of £985 million for its financial year to the end of March.
Following the update, its share price dropped 2.5 percent at the start of trading in London.
Group operations have since Easter been hampered by a ransomware sting which forced the retailer to suspend online sales, contactless payments at stores and even recruiting operations.
Marks said information stolen could include names, dates of birth, home addresses and telephone numbers. However, it did not include "useable payment or card details", nor account passwords.
The company reported the incident to relevant government authorities and law enforcement.
"There's still a big unknown regarding any potential fines on Marks and Spencer from the Information Commissioner's Office, which enforces data protection regulation" in Britain, noted Dan Coatsworth, investment analyst at trading group AJ Bell.
Taking into account the way the fine is calculated and previous penalties handed down to UK companies for data breaches, Marks could take a further hit totalling around £550 million, he added.
'Crime investigation'
Britain's National Crime Agency told the BBC it is investigating a series of cyberattacks including on luxury department store Harrods and the Co-op food chain.
"We are looking at the group that is publicly known as Scattered Spider, but we've got a range of different hypotheses," Paul Foster, head of the NCA's national cybercrime unit, told a BBC documentary.
The BBC said on its website "the hacks have been carried out using DragonForce, a platform that gives criminals the tools to carry out ransomware attacks."
Despite the Marks attack having a bigger impact, chief executive Stuart Machin described it as only "a bump in the road".
© 2025 AFP
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
LeMonde
6 hours ago
- LeMonde
BBC defends its Gaza reporting after White House accusation
The BBC on Wednesday, June 4, defended its reporting of an event during which Palestinians were killed near a Gaza aid center, after the White House accused the broadcaster of taking "the word of Hamas." Gaza's civil defense agency said Israeli gunfire killed at least 31 people on Sunday near the US-backed aid center. The Israeli military, however, denied its troops had fired on civilians in or around the center, and both it and the aid center's administrator accused Hamas of sowing false rumors. Responding to a question about the event, White House press secretary Karoline Leavitt said on Tuesday that the BBC had to "correct and take down" its story. "The administration is aware of those reports and we are currently looking into the veracity of them because, unfortunately, unlike some in the media, we don't take the word of Hamas with total truth," she said. "We like to look into it when they speak, unlike the BBC, who had multiple headlines," she said, citing stories that gave different death tolls. "And then, oh, wait, they had to correct and take down their entire story, saying 'We reviewed the footage and couldn't find any evidence of anything'," she added. 'Normal practice' But the BBC said the White House claims were not accurate and that it had not removed its story. "The claim the BBC took down a story after reviewing footage is completely wrong. We did not remove any story and we stand by our journalism," it said in a statement. It said headlines giving varying death tolls were "totally normal" journalistic practice due to the story being "updated throughout the day with the latest fatality figures as they came in from various sources." It said the death tolls were always "clearly attributed, from the first figure of 15 from medics, through the 31 killed from the Hamas-run health ministry to the final Red Cross statement of 'at least 21'", it added. Leavitt also criticised the Washington Post for its reporting of the incident. The Post deleted one article over sourcing issues "because it and early versions of the article didn't meet Post fairness standards." "The article and headline were updated on Sunday evening making it clear that there was no consensus about who was responsible."
Fashion Network
13 hours ago
- Fashion Network
M&S CEO Stuart Machin sees 39% pay rise to £7.1 million in 2024/25
British retailer Marks & Spencer's CEO Stuart Machin received a 39% increase in total compensation, rising to £7.1 million ($9.6 million) for the year ended March 2025, according to the company's annual filing on Monday. The pay rise was primarily driven by performance-linked awards, which surged 74% to £4.6 million. For salaries effective July 2025, the company's remuneration committee approved a 2% increase for Machin, raising his base salary to £865,694. ($1 = £0.7379) © Thomson Reuters 2025 All rights reserved.
Fashion Network
19 hours ago
- Fashion Network
Cartier reports some customer data stolen in cyberattack
Cartier, the luxury jewelry company owned by Richemont, had its website hacked and some client data stolen, it told customers, according to an email seen by Reuters. The company, whose watches, necklaces and bracelets have been worn by Taylor Swift, Angelina Jolie and Michelle Obama, said 'an unauthorized party gained temporary access to our system.' 'Limited client information,' such as names, email addresses and countries, had been obtained, said Cartier in the email sent to customers on Tuesday. 'The affected information did not include any passwords, credit card details or other banking information,' Cartier said, adding it had since contained the issue. The company said it had further enhanced the protection of its systems and data, as well as informed the relevant authorities, and was also working with 'leading external cybersecurity experts.' Cartier did not immediately respond to a request for comment. The attack is the latest case of a company being targeted by cybercriminals. British retailer Marks & Spencer said last month a 'highly sophisticated and targeted' cyberattack in April will cost it about 300 million pounds ($405 million) in lost profits. According to Le Monde newspaper, French luxury house Dior, owned by LVMH, also reported last month that hackers had stolen data from its customers but insisted no financial data was involved. Fashion brand The North Face, owned by VF Corporation, has also emailed some customers, saying it discovered a 'small-scale' attack in April this year. The company told customers the hackers used 'credential stuffing,' trying usernames and passwords stolen from another data breach in the hope customers have reused the credentials across multiple accounts, the BBC said on Tuesday. London department store Harrods also said last month that hackers had attempted to break into its systems, following incidents at Marks & Spencer and the Co-op Group.
