M&S and Co-op cyber attack update as shoppers hit with empty shelves, payment issues and meal deals chaos

The Sun

06-05-2025

Emily Mee
James Flanders
Sam Walker
Published: Invalid Date,
SHOPPERS are still having issues at both M&S and Co-op this week, a they're hit with empty shelves, payment issues and meal deals chaos.
Both supermarket giants have been hit by cyber attacks that have left them scrambling to keep stores running.
4
4
4
4
Co-op shoppers have reported they're unable to make card payments in some stores, with the tills having to switch to cash-only, and others are seeing empty shelves at the supermarket.
In M&S, some stores have had to suspend their meal deal offers due to a lack of availability of items.
One customer wrote on social media: "Cash only at the Co-Op today. That's three in Manchester I've seen with similar signs. One directly opposite the HQ."
Another said: "Our local co-op card machine has gone down and nobody can buy anything."
A third added: "Just been into The Co Op in Old St and lots of signs saying our system has gone down so Cash Only."
A different shopper said they had tried to use a Co-op cash point and received a message saying "pin compromised - unauthorised".
The Sun understands the vast majority of Co-op stores are still taking card payments, but around 10% of its 2,300 stores (roughly 230 locations) are unable to use contactless.
Shoppers have also said they're seeing empty shelves at Co-op branches.
"The Co-op at Ackworth has many empty shelves, especially for fresh products," one customer said.
Customers also reported a lack of availability in Pear Tree and Hurst.
Shoppers are racing to buy 'nostalgic' homeware from M&S - it's like being 'transported back in time' & looks 'designer'
A Co-op spokesperson said: "All our stores are open and trading however, due to the sustained malicious attempts by hackers to access our systems, we have taken proactive steps to keep our systems safe, which is temporarily impacting our colleagues' ability to perform their roles and how many deliveries we can make to our stores.
"This means that some of our stores might not have all of their usual products available and we would like to say sorry to our members and customers if this is the case in their local store. We are working around the clock to reduce disruption and resume deliveries.
"We would like to thank our colleagues, members, customers, and suppliers for their understanding during this time."
Staff at the Co-op in Westminster Park, Chester, said its teams were working "day and night" to try to fix the problems.
They wrote on Facebook: "Our availability…. Our gaps in the store have quintupled! We know the store is looking like Covid times but the recovery process is starting to begin.
"The most common question we're getting is 'do you have this in the back'…. The reality is the chiller is empty, the freezer is empty & we have a case of Carlsberg & a case of water in the back. That's it!"
The store said it is expecting deliveries today but is having to scan every single item in by hand.
Customers showed their support on the post, writing: "You're doing amazing and thanks for updating us x."
Another said: "Many thanks for keeping us updated. Hope things are back to normal soon."
M&S meal deal issues
Meanwhile, M&S has been forced to temporarily suspend its meal deal offers in some of its smaller stores in transport hubs.
The supermarket usually offers meal deals in its stores inside train stations and petrol stations.
But signs posted in stores, including at Victoria Station and London Bridge, said: "Due to availability issues, we are temporarily unable to fulfil this meal deal. Please bear with us while we work through this."
The Sun understands the reason for the suspension is because some parts of the meal deal aren't available, such as crisps or drinks, rather than an issue with tills.
M&S said: "Customers can still buy meal deals in our rail station stores but there are pockets of availability for some items.
"We are working hard to continue getting our products into stores."
Which chains have been affected by cyber attacks?
M&S was the first to be hit more than two weeks ago when its contactless payments went down and there was disruption to click and collect orders.
Things got even worse for the supermarket when it was then forced to suspend all online orders through its app and website.
It said at the time this was part of its "proactive management" of the cyber attack and that it was "truly sorry" for the disruption.
Shoppers then started experiencing empty shelves and shortages of popular items including bananas, fish and the iconic Colin the Caterpillar cakes.
Insiders at M&S have told Sky News they have no idea whether hackers are still inside the M&S system and it could take months for things to get back to normal.
Last week it was reported Co-op had also faced a hacking attempt and was forced to shut down part of its IT system.
It told staff at the time it had "taken proactive steps to keep our systems safe".
However it was later reported that a "significant number" of the supermarket's 6.2million customers and past members had their data stolen.
This included personal details such as names, contact information and dates of birth.
The retailer said members' passwords, credit card details and transaction information were not leaked.
It said "malicious" hacking attempts were still ongoing and it is dealing with a "highly complex" situation.
After Co-op, Harrods became the third retailer to report a hacking attempt.
Shoppers were warned the company had "restricted internet access" after the attempted breach which left some customers struggling to pay.
All of its sites and website appear to be working as usual now.
Criminal gang thought to be behind attack
The National Crime Agency and National Cyber Security Centre are investigating the situation.
Insiders have said an infamous criminal gang known as "Scattered Spider" is to blame for the M&S attack.
Scattered Spider is one of the most prolific cyber gangs of the past 18 months.
It specialises in ransomware, a type of attack designed to steal information or access in exchange for a sum of money.
Timeline of cyber attack
Saturday, April 19: Initial reports emerge on social media of problems with contactless payments and click-and-collect services at M&S stores across the UK. Customers experience difficulties collecting online purchases and returning items due to system issues.
Monday, April 21: Problems with contactless payments and click-and-collect persist. M&S officially acknowledges the "cyber incident" in a statement to the London Stock Exchange. CEO Stuart Machin apologises for the disruption and confirms "minor, temporary changes" to store operations. M&S notifies the National Cyber Security Centre (NCSC) and the Information Commissioner's Office (ICO) and engages external cybersecurity experts.
Tuesday, April 22: Disruptions continue. M&S takes further systems offline as part of "proactive management".
Wednesday, April 23: Despite earlier claims of customer-facing systems returning to normal, M&S continues to adjust operations to maintain security. Contactless payments are initially restored, but other services, including click-and-collect, remain affected.
Thursday, April 24: Contactless payments and click-and-collect services are still unavailable. Reports surface suggesting the attackers possibly gained access to data in February.
Friday, April 25: M&S suspends all online and app orders in the UK and Ireland for clothing and food, although customers can still browse products. This decision leads to a 5% drop in M&S's share price.
Monday, April 28: M&S is still unable to process online orders. Around 200 agency workers at the main distribution centre are told to stay home.
Tuesday, April 29: Information suggests that the hacker group Scattered Spider is likely behind the attack. Shoppers spot empty shelves in selected stores.