Marks & Spencer (M&S) has resumed online orders for clothing, home, and beauty products, nearly seven weeks after a major cyber attack forced the retailer to suspend its digital operations. The return of online shopping marks a significant milestone for the high street giant, which has faced weeks of disruption and mounting financial losses since the incident in April.
M&S confirmed that customers can now place online orders for home delivery across England, Scotland, and Wales, with more products being added daily. Deliveries to Northern Ireland, as well as click and collect, next-day, and international delivery services, are expected to resume in the coming weeks.
John Lyttle, managing director of clothing, home, and beauty at M&S, said in a LinkedIn post:
“We are bringing back online shopping this week. Every day, we will be adding more of our fashion, home, and beauty items, and in the upcoming weeks, we will also restart deliveries to Northern Ireland and Click and Collect services. We sincerely appreciate your support and for choosing to shop with us.”
Impact of the Cyber Attack
The cyber attack, which occurred during the Easter weekend, initially disrupted contactless payments and click and collect services before forcing a complete halt to online orders on April 25. The breach, attributed to hackers infiltrating systems via a third-party contractor, resulted in significant stock shortages and delays, with some stores experiencing “pockets of limited availability.”
M&S has estimated the cost of the disruption at up to £300 million in lost operating profit for the 2025/26 financial year, with around half expected to be recovered through insurance and mitigation measures. The company reported losing up to £25 million a week in online clothing and homeware sales during the downtime.
Chief executive Stuart Machin acknowledged the scale of the challenge, stating:
“We didn’t leave the door open; this is not related to under-investment. Everyone is at risk. Unfortunately, we were unlucky on that particular day due to some human error.”
Customer Data and Security Response
During the breach, some personal customer information – such as names, addresses, dates of birth, and past orders – was compromised. However, M&S reassured customers that payment information and passwords were not accessed.
The company has urged customers to remain vigilant for potential fraudulent communications.
M&S has used the incident as a catalyst to accelerate investment in its technology infrastructure. In its financial results, the company stated:
“In light of the recent cyber incident, we are using the disruption to bring forward investment, rephasing the original programme, accelerating plans to upgrade infrastructure and network connectivity, store and colleague technology, and supply chain systems. This will reduce the inter-dependency of systems and improve operational resilience.”
Ongoing Challenges and Industry Context
The attack on M&S is part of a broader wave of cyber incidents affecting the retail sector, with other major brands such as Co-op, Harrods, Dior, and Victoria’s Secret also targeted this spring. Security researchers have linked the M&S breach to the Scattered Spider and DragonForce hacker groups.
M&S’s leadership has not commented on whether a ransom was paid, despite hackers sending a direct and abusive email to CEO Stuart Machin demanding payment and boasting about the attack.
As M&S continues to restore its digital services, the company is focused on regaining customer trust and building greater resilience against future threats.
