Marks & Spencer and the Attack That Halted the Online Store of One of the World's Best-Known Retailers

When a Retail Giant Grinds to a Halt: The 2025 Marks & Spencer Incident

In April 2025, Marks & Spencer, one of the world's most recognized retail chains with more than 140 years of history, publicly confirmed that it had been the victim of a large-scale cyberattack. The incident forced the company to suspend online orders, caused severe disruptions to its e-commerce operations, and drove the company's shares down as much as 4.8% in trading on April 25, 2025 on the London Stock Exchange. In a statement to the London Stock Exchange on May 21, 2025, M&S itself estimated an impact of around £300 million on operating profit for fiscal year 2025/26, before mitigation through insurance and cost cuts (BleepingComputer).

Citing sources close to the investigation, industry media have identified the cybercriminal group known as Scattered Spider as responsible for the attack. The group has drawn international attention for its skill at manipulating people inside organizations to gain privileged access to critical systems, using sophisticated social engineering techniques as its entry vector. M&S notified the relevant UK regulators, fulfilling its legal obligations under the British data protection regime.

The operational impact was immediate and visible: customers were unable to complete online purchases, inventory became outdated, and the reputation of a century-old brand suffered public damage that no marketing investment can quickly repair. An e-commerce outage lasting days, for a large retailer, can represent tens of millions in directly lost revenue, in addition to remediation costs, legal fees, and forensic investigations.

The M&S case is not an isolated one. According to IBM's Cost of a Data Breach 2023 report, the average global cost of a data breach reached US$ 4.45 million per incident, the highest figure ever recorded by the study, which has been published for 18 years. For the retail sector, where digital continuity is a critical revenue driver, the real costs, including reputational damage and customer loss, can multiply that figure several times over.

Attack Vectors That Incidents Like This Typically Exploit

Although the internal details of the M&S incident are not entirely public, attacks attributed to the Scattered Spider group and similar groups follow well-documented patterns. The first and most common vector is targeted social engineering. In these attacks, the criminal does not need a sophisticated technical vulnerability: they call the IT or HR helpdesk pretending to be an employee in distress, manipulate the attendant into resetting credentials or bypassing verification processes, and gain legitimate access to critical systems. A well-intentioned employee, without adequate training to recognize this type of approach, can open the front door of your infrastructure without realizing it. Organizations that rely on informal identity verification processes for technical support are especially vulnerable.

The second critical vector is the absence of proactive monitoring and real-time detection. In highly sophisticated attacks, the intruder often remains inside the environment for days or weeks before triggering any destructive payload, moving laterally between systems, escalating privileges, and identifying high-value assets. Without a continuous monitoring layer that correlates anomalous behaviors — such as a user accessing unusual volumes of files outside normal hours, or an account authenticating across multiple systems in rapid succession — this invisible movement is only detected once the damage is already done.

The third vector is the lack of network segmentation combined with the absence of multi-factor authentication (MFA). When an IT environment has no internal barriers between systems, a single compromised credential can give the attacker unrestricted access to production servers, customer databases, payment systems, and backups simultaneously. MFA, which requires a second verification factor beyond the password, is one of the simplest and most effective defenses against the misuse of valid credentials, yet its adoption remains inconsistent across many organizations, especially for administrative and remote access.

What Your Company Can Do to Protect Itself

The first layer of protection starts at the endpoints, that is, the devices your employees use every day. EDR (Endpoint Detection and Response) solutions go beyond traditional antivirus: they monitor behavior in real time, identify suspicious process execution patterns, and let you isolate a compromised device from the network in seconds, before the attack spreads. Organizations that use managed EDR significantly reduce the mean time to contain an incident, which, according to IBM's Cost of a Data Breach 2023 report, took an average of 73 days to contain after 204 days to identify.

The second layer is isolated, encrypted, and regularly tested backup. Backups that are connected to the same network as production systems can be encrypted or destroyed alongside the original data in a ransomware attack. The proper architecture requires immutable copies, stored in a segregated environment, with periodic restoration tests that validate the RTO (Recovery Time Objective) and RPO (Recovery Point Objective). Without these tests, a backup is nothing more than an unverified promise.

The third layer is ongoing user training combined with a documented, tested incident response plan. People remain the most exploited link in sophisticated attacks like the one on M&S. Regular awareness programs with phishing simulations and social engineering scenarios measurably reduce click rates on malicious links: in KnowBe4's 2025 study, the average phishing susceptibility rate dropped 40% after three months and 86% after 12 months of training. At the same time, an incident response plan that clearly defines who does what in the first hours of a crisis can be the difference between an outage of hours and a shutdown of days.

Questions Every Decision-Maker Should Be Asking Right Now

1. Would my backups actually work in a disaster like this? How quickly could my operations be back up and running?

2. Does my team have the right tools to identify and block an attack like this immediately, before it causes a full-blown disaster? How am I investing in the preparedness of my technical team?

3. How long could my company survive without access to its systems and files?

Would my backups actually work in a disaster like this? How quickly could my operations be back up and running?

Having a backup is not the same as having guaranteed recovery. Most organizations discover this at the worst possible moment: during the incident itself. A valid backup must be isolated from the production network, encrypted to protect the recovery data itself, and tested at regular intervals with real restoration simulations. Structured managed IT includes periodic backup validation routines, with documented RTO and RPO reports, so that decision-makers know exactly how long it will take to resume operations — not by estimate, but by tested evidence. If your company has never run a full recovery test, that number is unknown — and unknown is unacceptable in risk management.

The impact of days without operations goes far beyond lost revenue. Customers migrate to competitors, contracts are breached, regulatory fines may be imposed, and the trust of your customer base suffers damage that takes months to repair. Defining the tolerable RTO for your operation — and ensuring that your backup and recovery infrastructure is tested against that number — is a strategic decision that must involve the CEO, not just the IT team.

Does my team have the right tools to identify and block an attack like this immediately, before it causes a full-blown disaster?

Tools without context do not protect. An internal IT team focused on operational support rarely has the capacity to operate security monitoring 24 hours a day, 7 days a week, correlating real-time alerts and responding to incidents outside business hours — which is precisely when sophisticated attacks tend to be triggered. Proactive monitoring with intelligent alerts, operated by a specialized managed IT structure, ensures that anomalous behaviors are identified and addressed before they become disasters. In addition, continuous patch and vulnerability management — keeping operating systems and applications up to date without exploitable open windows — eliminates an entire class of attack vectors that rely on known flaws.

Investing in technical team preparedness goes beyond certifications: it includes regular incident response simulations, access to up-to-date threat intelligence, and integration with clear escalation processes. When a critical alert comes in at 2 a.m., the question is not whether someone will see it, but whether the response process is already defined and being executed by those who have the right tools and adequate training.

How long could my company survive without access to its systems and files?

This is the most honest question a decision-maker can ask about their own digital resilience. For retailers like M&S, hours without e-commerce represent millions in lost revenue. For smaller companies, days without access to ERP, CRM, or operational file systems can simultaneously derail contracts, payments, and deliveries. A documented and tested incident response plan defines exactly which systems are prioritized, in what order recovery occurs, and which emergency manual processes can sustain operations while systems are being restored. Without that plan, every hour of a crisis is improvised — and improvisation in cybersecurity is costly.

The answer to this question also reveals the organization's real risk appetite. Companies that respond with "we wouldn't survive more than 24 hours" urgently need to size their investments in redundancy, segmentation, and recovery to align with that operational reality. Structured managed IT translates that risk appetite into concrete technical architecture, with defined and monitored recovery SLAs.

If your company does not yet have an integrated layered protection strategy, consider conducting a Strategic IT Diagnostic, with no commitment, to identify vulnerabilities before they become headlines.