Cyber Heist Blindsides Marks & Spencer with Major Outages

Cyber Heist Blindsides Marks & Spencer with Major Outages

Summary

• Marks & Spencer, the British retailer, was hit by a ransomware attack that caused major service outages.
• The attack disrupted online operations, costing sales and testing customer trust.
• The incident adds to pressure on retailers to strengthen defenses against ransomware.
• Retail’s exposure to ransomware is drawing attention from regulators and the industry.

Ransomware hits Marks & Spencer

Marks & Spencer was hit by ransomware in April 2025. The attackers got past the retailer’s defenses and took over critical systems, and the result was a run of major service outages, online operations included, at one of Britain’s best-known high street names.

Even large, well-funded retailers get caught out. M&S has not said how the attackers got in.

Online sales take the hit

Online sales took the heaviest blow. Shutting down online services stopped transactions and cost the company sales, and customers who could not place orders also worried about whether their personal data had been taken.

Beyond the immediate losses, rebuilding customer trust could take longer than restoring the systems.

Part of a wider wave

M&S joins a growing list of large companies disrupted by ransomware. The gangs behind these attacks keep refining their methods and hit businesses across industries.

Reports of ransomware against retailers have grown, according to the National Cyber Security Centre, adding to calls for stronger defenses.

The attacks are getting worse.

What retailers are doing

M&S and other retailers are reviewing their defenses. Expect more layered controls and encryption.

Governments and industry groups want companies to treat security as part of business planning. They also want retailers to share threat information so one company’s attack becomes everyone’s warning.

Lessons for other retailers

As M&S works to recover, its experience offers lessons. Retailers depend on online sales and connected store systems. That makes downtime expensive. Tested backups, segmented networks and a practiced response plan decide how long an outage lasts.

Any retailer could be next. The ones that recover fastest will be those that planned for it.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.