UK retailer Marks & Spencer puts cyberattack cost at $400 million with disruptions ongoing

Key Points

• Marks & Spencer estimates the cost of a “highly sophisticated” cyberattack at about £300 million ($400 million), with disruptions expected to continue until July.
• The attack halted online orders for food, home and beauty products, leaving store shelves empty and forcing manual processes.
• Profit was hit by reduced food availability, increased waste and additional logistics costs.
• Hackers accessed customer personal data—potentially including names, emails, addresses and dates of birth—amid similar attacks on Harrods and Co-op.

LONDON (AP) — British retailer Marks & Spencer estimated Wednesday that a cyberattack that stopped it from processing online orders and left store shelves empty will cost it about 300 million pounds ($400 million).

The company said in a business update that disruption from the “highly sophisticated and targeted cyber attack,” which was first reported around the Easter weekend, is expected to continue until July.

Online sales of food, home and beauty products have been “heavily impacted” because the company, popularly known as M&S, had to pause online shopping.

Profits were dented because of “reduced availability” in food sales, as well as extra waste and logistics costs because shops had to resort to “manual processes,” Marks & Spencer said.

Chief executive Stuart Machin said the company is focused on recovery and restoring its systems and operations.

“This incident is a bump in the road, and we will come out of this in better shape,” Machin said. He did not provided any details on the attack or who might be behind it.

Earlier this month, the company said customer personal data, which could have included names, emails, addresses and dates of birth, were taken by hackers in the attack.

Two other British retailers, luxury London department store Harrod's and supermarket chain Co-op, have also been targeted by cyberattacks at around the same time.