Marks & Spencer Battles Back: Online Orders Resurrect Post-Cyberattack
Key points
- Marks & Spencer suffers a major cyberattack that knocks out online ordering for customers.
- The retailer has restored some online ordering.
- Security experts stress strong defenses against sophisticated attacks.
- Marks & Spencer is working with security experts to find and fix weak points and tighten future security.
Online orders come back
Cyberattacks keep hitting big-name companies, and Marks & Spencer is now fighting one that took its online ordering platform offline. The retailer, known for selling everything from clothing to food, moved to bring some of its online operations back. It is an early but real step toward recovery.
The incident shows how persistent online threats are for businesses of every size, disrupting operations and shaking customer trust. M&S has kept serving customers through it. That says something about the company’s resilience.
What the attack disrupted
The attack badly disrupted M&S’s online operations, mainly customers’ ability to place orders. Details of the attack have not been disclosed. It fits a growing pattern of criminals using advanced techniques against major retailers.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
The attack created operational problems and also tested how well the company could protect confidential customer data, a top concern at a time when a breach can do lasting damage to a brand and to customer trust.
Getting orders flowing again
M&S started recovery work right after the attack. It has restored part of its online ordering system, so customers can place orders again.
A Marks & Spencer spokesperson said the company is committed to resolving the situation and giving customers a smooth, reliable shopping experience. The quick action shows how hard the company is working to limit disruption.
What security experts recommend
Security specialists around the world keep warning about how threats are changing. Attacks are getting more sophisticated. Companies have to strengthen their defenses.
Specialists say scalable security tools and regular system audits are now a necessity. They help companies prevent and detect threats, and respond faster when one gets through.
The M&S attack shows why companies need careful security practices and close work with security experts to protect customer data and keep operations running.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
What other retailers can learn
M&S’s quick response offers a lesson for retailers about preparing for intrusions. A strong security strategy is about more than defense. It keeps the business running and customers loyal in a crisis.
As M&S keeps reviewing and improving its security, the retail industry is watching closely. The fight against cybercrime does not end.
Retailers should improve their defenses now and write clear incident response plans, so they can recover quickly when an attack hits.
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Citrix NetScaler CVE-2026-19490: The Auth Bypass That Went From PoC to Probes in a Day
CVE-2026-19490 is a CVSS 9.3 NetScaler Gateway/AAA auth bypass. A public PoC on Sept 2 was followed by live probes within a...
PaperCut NG/MF: The Print Server That Learned Remote Code Execution Again
CVE-2026-81578 and CVE-2026-82078 chain to pre-auth RCE on PaperCut Application Server. Confirm Emergency Patch Release 2, restrict admin exposure, and hunt like...
JFrog Artifactory CVE-2026-82329: Empty Join Key, Full Admin Token, Busy Scanners
CVE-2026-82329 lets attackers forge Artifactory admin tokens via a deterministic empty join key. Mass scanning peaked near 406,000 attempts; patch fixed builds...
Friday’s brief: GitLab’s 10.0 fix, then VeloCloud attacks, a poisoned LiteLLM release and PHP2Shell logs to check
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.