Mystery Deepens: M&S Cyber Attack Sparks Widespread Security Concerns

At a glance

• Marks & Spencer (M&S), one of the UK’s best-known retailers, disclosed a cyber incident on April 22, 2025, after problems over the Easter weekend.
• Contactless payments and Click & Collect were disrupted, and on April 25 the company paused all online and app orders in the UK and Ireland.
• M&S reported the incident to the National Cyber Security Centre, which worked with the company and the National Crime Agency.
• Stores stayed open, but the full scope of the attack was still unclear when this was written.

A retailer goes offline

M&S told customers and investors on April 22, 2025, that it had been dealing with a cyber incident for several days. Shoppers had already noticed. Contactless card payments in stores failed for a time and Click & Collect orders stopped working. Gift cards were hit too.

How the incident unfolded

On April 25 the company went further and paused online and app orders altogether while it worked to contain the attack. Contactless payments had been restored by then. M&S said it had brought in external cyber experts and was working with the National Cyber Security Centre and law enforcement.

The company did not say at first what kind of attack it was or whether customer data had been taken. That silence is normal early in an investigation, but it made the disruption hard for shoppers and investors to judge.

What the attack shows

An earlier version of this article quoted a “Julia Harris, a renowned cybersecurity analyst.” We could not find that person or the quote and have removed it.

The broader point stands. A retailer that depends on connected payment systems, warehouses and websites can lose a large share of its sales when attackers get in, and recovery can take weeks.

Lessons for other retailers

Retailers with complex supply chains and many third-party IT providers have a lot of ways in. Help desks and outsourced support staff are frequent targets, since a convincing phone call can be enough to reset a password.

Testing incident plans before an attack matters. So does being able to run stores, take payments and fulfil orders when core systems are offline.

Update

Later reporting linked the attack to the group known as Scattered Spider, which used social engineering to get in, and to DragonForce ransomware. Online orders stayed paused for 46 days and resumed on June 10, 2025.

For other companies, the M&S case is a clear example of how long a single intrusion can disrupt a large business. Check how your help desk verifies callers, and practice running key operations without your main systems.

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.