Marks & Spencer (M&S), a leading British retailer operating over 1,400 stores globally, has suspended online ordering after a cyberattack disrupted operations. The incident affects its websites, mobile apps, and several in-store services.
The company, which reported £13 billion in FY24 revenue and is a constituent of the FTSE100 Index, disclosed the cybersecurity event through a London Stock Exchange announcement. M&S confirmed it is working with external cybersecurity experts to contain the breach and restore services.
In an update, M&S stated:
“As part of our proactive management of a cyber incident, we have made the decision to pause taking orders via our M&S.com websites and apps. Our product range remains available to browse online.”
Source (BleepingComputer)
The cyberattack, detected earlier in the week, impacted services such as contactless payments and Click & Collect fulfillment. M&S noted that “all orders will be held by stores for the foreseeable” and some systems have been taken offline to protect partners, suppliers, and operations.
M&S thanked customers and stakeholders for their support, adding that it is “working hard to restore services” with the assistance of leading cybersecurity specialists.
No ransomware group or threat actor has publicly claimed responsibility. Although no data leak has been reported yet, incidents of this nature often involve data theft leveraged for extortion. If ransomware was deployed, M&S data may have been compromised but not yet published.
As of today, M&S services remain limited. Customers are advised to monitor official updates for service restoration timelines.
