London, May 5, 2025 – Marks & Spencer (M&S) is grappling with the aftermath of a significant cyber attack that has forced the retailer to suspend online orders and halt recruitment efforts, with insiders indicating it could take months” for the company to fully recover.
According to an anonymous employee speaking to Sky News, the situation has been chaotic, revealing a lack of preparedness for such incidents. The insider stated, We didn’t have any business continuity plan [for this], we didn’t have a cyber attack plan,” highlighting the stress and disruption faced by staff who have been working under challenging conditions.
The insider further explained that the recovery process is expected to be gradual, with plans to restore services incrementally rather than all at once. Employees are currently forced to use personal devices for work due to restrictions on company devices, adding to the confusion and lack of communication as internal advice continues to change.
M&S has publicly apologized for the disruption, with Chief Executive Stuart Machin assuring customers that the company is working day and night” to resolve the situation. Despite the claims of inadequate preparation, an M&S spokesperson stated that the company has robust business continuity plans and processes in place for managing incidents.”
In light of the ongoing cyber threat landscape, Cabinet Office minister Pat McFadden is set to address the CyberUK conference, emphasizing the need for businesses in the UK to prioritize cybersecurity. He will describe recent attacks as a wake-up call,” urging companies to treat their digital operations with the same security diligence as their physical premises.
The situation at M&S underscores the growing risks businesses face from cyber attacks and the critical importance of having comprehensive incident response strategies in place.
