M&S estimates massive losses after cyber attack

Marks and Spencer (M&S) has estimated that its operating profit will take a £300m hit following a severe cyber attack.

The attack, which came to light in April 2025, led to food sales being impacted by reduced availability and online shopping being paused.

In a trading update on 21 May 2025, M&S said that it expects “online disruption to continue throughout June and into July as we restart, then ramp up operations”.

“This will also mean increased stock management costs in the second quarter,” it added.

The retailer went onto say that it was expecting the cyber attack to have an impact on group operating profit of around £300m for 2025/26.

However, this is set to be reduced through management of costs, insurance and other trading actions.

According to the Financial Times, people familiar with the matter said that the UK retailer’s cyber policy allows it to claim up to £100m and that Allianz is expected to pay at least the initial £10m.

Beazley is also potentially among the insurers exposed to losses, the report added.

M&S recovery plans

Following the big implications of this cyber attack, M&S said it was accelerating the “pace of improvement of our technology transformation” and that it had “found new and innovative ways of working”.

“We are focused on recovery, restoring our systems, operations and customer proposition over the rest of the first half, with the aim of exiting this period a much stronger business,” it added.

“Overall, our strategy remains the same and there is no change to our longer-term plans to reshape M&S for growth.

“We are confident that we will enter the second half with a strong customer proposition, returning to the performance we were delivering immediately prior to the incident and throughout 2024/25.”