The recent cyber-attack on M&S has hit the UK retailer hard, costing it £300M from its 2025/26 expected profit, the retail giant has confirmed in a trade update.

The attack impacted food sales due to the reduced availability of products, as well as an increase in waste and logistical costs associated with more manual labour in operation processes.

M&S has said previously that it’s working “around the clock” with its suppliers to stabilise its operations and contain the incident.

Online sales, however, across the retail giant’s home and fashion departments continue to be “heavily impacted.”

The retailer says that it expects online disruptions to continued “throughout June and into July as we restart, then ramp up operations.

“This will also mean increased stock management costs in the second quarter,” M&S said.

M&S says it aims to reduce the £300m impact to its profit by cost management, insurance and “other trading actions.”

“We are seeking to make the most of the opportunity to accelerate the pace of improvement of our technology transformation and have found new and innovative ways of working.

“We are focused on recovery, restoring our systems, operations and customer proposition over the rest of the first half, with the aim of exiting this period a much stronger business.”

Recommended reading

• How Scattered Spider’s Web Brought UK Retail to its Knees
• M&S Confirms Customer Data Breach After Cyber-attack
• Cyber-attacks A “Wake-up Call” to Retail Sector

While the impact on M&S continues, the National Crime Agency confirmed to the BBC that they are investigating Scattered Spider in relation to the cyber-attack on M&S as well as Co-op.

While it had long been reported and speculated that Scattered Spider was behind the attack, this is the first confirmation that law enforcement is investigation the loosely connected cyber gang.

Scattered Spider is most intriguing for its unusual attributes – its network of cyber-criminals are mainly native English speakers, and are young, with some members just in their teens. Unlike many cyber gang networks, confirmed associates have been residents in the US and UK.

The cyber-attacks against the UK retail world were carried out using Dragonforce, a ransomware platform, but currently, those behind the attacks have yet to be confirmed.

The NCA has not confirmed that Scattered Spider was behind the attack, and told the BCC that the organisation had “a range of different hypotheses.”