By James Davey and Paul Sandle
LONDON (Reuters) -A “highly sophisticated and targeted” cyberattack will cost Marks & Spencer about 300 million pounds ($403 million) in lost operating profit, and disruption to online services is likely until July, the British retailer said on Wednesday.
The attack on one of the biggest names on the British high street forced M&S to resort to pen and paper to move billions of pounds of fresh food, drinks and clothing after it switched off its automated stock system.
That led to bare food shelves and frustrated customers.
Nearly a month on, the retailers’ large online clothing service remains offline, with a return to normal not expected before July. The attack has wiped more than a billion pounds off its stock market value.
Chairman Archie Norman said after years of hard work, M&S had been starting to show its full potential.
“But in business life just as you think you’re onto a good streak, events have a way of putting you on your backside,” he said.
M&S, which has 65,000 staff and 565 stores, said the hack would cost about 300 million pounds in lost operating profit in its year to March 2026, although it hopes to halve that through insurance, cost control and other actions.
M&S reported 984.5 million pounds in the year ended March 29.
The group, which was trading strongly before the hack, said online sales and trading profit in its fashion, home and beauty division had been “heavily impacted” by the decision to suspend online shopping, though store sales had “remained resilient”.
It said online disruption would continue throughout June and into July as it restarts systems and then ramps up operations.
Chief Executive Stuart Machin told reporters he expected about 85% of clothing and home lines to be available online in a few weeks.
In food, M&S said it had been hit by reduced availability and higher waste and logistics costs. It said food sales had since improved.
Shares in M&S were down 3% in early trade before they recovered to be up nearly 1%.
The group said it would use the crisis to accelerate a planned technology transformation programme to take six months rather than two years.
“We are focused on recovery, restoring our systems, operations and customer proposition over the rest of the first half, with the aim of exiting this period a much stronger business,” it said.
‘WE DIDN’T LEAVE THE DOOR OPEN’
British companies and institutions have been hit by increasingly aggressive and regular cyber and ransomware attacks in recent years, with the British Library, a blood testing service and the London Underground all suffering months of disruption.
M&S, which said last week that some personal customer information had been stolen in the hack, refused to say whether it had paid a ransom and said the time between hackers gaining access to its system and detection was short.
Machin gave few details about the nature of the attack, but said M&S had been unlucky “through human error”, with hackers adopting “social engineering” tactics, used to trick people into disclosing information.
“We didn’t leave the door open, this wasn’t anything to do with underinvestment,” said Machin.
With hackers having also hit the Co-op and Harrods in Britain, and Google saying last week those responsible were targeting U.S. companies, retailers worldwide are racing to boost defences.
Machin said UK retailers were supporting each other.
The cyberattack came at a bad time for the much-loved retailer, after a comprehensive turnaround plan started to pay off.
Its adjusted pretax profit in the last financial year was up 22.2%, the highest in over 15 years and comfortably ahead of analysts’ average forecast.
Sales increased 6.1% to 13.9 billion pounds, with food sales up 8.7% and clothing, home and beauty sales up 3.5%, as the group gained market share in both divisions.
Some rivals stand to benefit from M&S’ online problems.
Clothing rival Next, which raised its profit outlook earlier this month after strong first quarter trading, is among those likely to get a trading tailwind, as are John Lewis, Tesco and Sainsbury’s, analysts said.
($1 = 0.7443 pounds)
(Reporting by James Davey, editing by Paul Sandle, Kate Holton and Barbara Lewis)
