U.K. department store chain Marks & Spencer said Wednesday that the cyberattack it disclosed in April will shave $400 million (300 million British pounds) off of its group operating profits and continue disrupting online transactions through July.
The company said the attack affected food sales because of reduced availability. Online sales and trading profits for fashion, home and beauty products have also suffered because of the company’s need to temporarily reduce online shopping services.
The company said department stores have remained resilient during the recovery process.
“April started strong, continuing the momentum from last year,” M&S CEO Stuart Machin said during a prerecorded presentation as part of the company’s fiscal-year earnings report. “Then, over the Easter break holiday, it became clear we were facing a highly sophisticated and targeted attack.”
Machin said the company proactively took down some of its systems, which resulted in short-term disruptions but were necessary to protect its systems, customers and partners.
M&S now plans to accelerate a technology improvement plan from a two-year time frame to a six-month time frame in light of the need to prevent another disruption.
The company in 2023 outlined plans to improve its technology stack, including investments in infrastructure, network connectivity, store technology and supply-chain systems.
The company said the 300-million-pound financial impact from the cyberattack reflected a preliminary tally before cost mitigation, insurance and trading actions.
Cybersecurity experts believe the M&S attack was the work of the notorious cybercrime gang Scattered Spider, a group best known for hacking MGM Resort in 2023. The same hackers also breached the famed U.K. department store Harrods and the major U.K. supermarket company Co-op between mid-April and early May.
Google threat intelligence researchers have warned that the same group is now targeting U.S. retailers.
The financial fallout at M&S highlights the potential impact of cyberattacks on business operations and finances.
“Time and time again, we see that business disruption is one of the most immediate and devastating effects cyberattacks can have,” Allie Mellen, principal analyst at Forrester, told Cybersecurity Dive via email.
“While no organization is immune to attack,” Mellen said, “taking fundamental steps ahead of time can help organizations prepare for and recover from this type of attack faster.”
Legal experts said the fallout from this attack may affect M&S for years.
“A challenge for any business dealing with a major breach is the opportunity cost created by the distraction from business as usual,” said Jo Joyce, a partner who co-leads the U.K. and Ireland cyber law practice at Taylor Wessing. “New initiatives and launches will be delayed or canceled, and the business will likely be significantly behind in its plans.”