M&S boss says firms should be legally required to report cyber-attacks

The Guardian

08-07-2025

UK businesses should be legally required to report major cyber-attacks, the boss of Marks & Spencer has suggested as he claimed two hacks involving 'large British companies' had gone unreported in recent months.
In evidence to MPs about the impact of the massive cyber-attack on M&S that forced it to close down its online store for almost seven weeks, the retailer's chair, Archie Norman, said the business was still in 'rebuild mode'.
He said its key online clothing distribution centre in Castle Donington in Leicestershire still offline, adding 'it would not be an overstatement to describe [the attack] as traumatic' and 'like an out of body experience'.
Norman told parliament's business and trade sub-committee on economic security, arms and export controls that M&S had been quick to report the hack to the UK's cyber watchdog – the National Cyber Security Centre – which had helped others protect themselves about the hackers with other businesses.
He said making such reports mandatory was 'a very interesting idea' as 'it is apparent to us quite a large number of serious cyber-attacks never get reported to the NCSC'.
'We have reason to believe there have two major cyber-attacks on large British companies in the last four months that have gone unreported,' he said.
His claim comes after MP David Davis claimed in parliament that an unnamed British company 'had paid a very large sum to its blackmailer recently'.
Norman would not comment on whether M&S had paid a ransom, saying it was 'a matter of law enforcement' and the business was 'not discussing any of the details of interaction with threat actor'.
However, he said any business paying a ransom might have to ask themselves what they would get in return. 'In our case substantially the damage had been done,' he said.
The attack on M&S which began on 17 April and was spotted by M&S a couple of days later, involved the deployment of ransomware. A hacking collective known as Scattered Spider has been linked to the attack.
Norman said the hack had been sophisticated, involving impersonation and a third-party contractor.
'There have been media reports M&S leaving the back door open. We didn't,' Norman said.
Sign up to Business Today
Get set for the working day – we'll point you to all the business news and analysis you need every morning
after newsletter promotion
He said the group had spent hundreds of millions of pounds on improving its cybersecurity in the year before the attack and tripled its prevention team to 80.
'Anybody that had suffered such a major cyber-attack cannot say thousand things you could have done differently,' he said. However, he suggested it was almost impossible for an organisation with so many workers and contractors to keep out a determined 'threat actor'.
M&S's general council Nick Folland told MPs that M&S would advise other businesses to 'make sure you can run your business on pen and paper because that is what you need to do' when a serious attack hits.
All organisations must already report significant breaches of personal data to the Information Commissioner's Office, the UK's data protection watchdog, within 72 hours.