In 2025 one of Britain’s best-known brands suffered a major cyber attack.
Marks and Spencer (M&S) is thought to have lost around £300 million in what proved to be a stark reminder that no organisation is immune. Even large, well-resourced companies with considerable tech investment are vulnerable.
So, what can we learn from what went wrong at M&S, and crucially, how can you ensure it doesn’t happen to your business?
What we know about the M&S cyber attack
Social engineering techniques tricked the employees of a third-party contractor, enabling attackers to bypass M&S security defences and steal personal customer data including names, addresses, dates of birth and order histories.
Online orders through the M&S website and app had to be suspended and click and collect services were disrupted, along with various other operations.
It took weeks to get online ordering back up and running and months before all services were restored, causing frustration for customers on top of the financial losses.
What went wrong
Several failures contributed to the scale of the attack.
Instead of exploiting a technical vulnerability in M&S’s main perimeter, attackers used human vulnerabilities to target the third-party contractor, thought to be Tata Consulting Services.
Phishing or impersonation techniques allowed them to dupe the contractor’s staff and gain access to M&S systems.
Even though the attack was spotted quickly, it looks like attackers moved quickly through many systems before the attack was contained.
Like all large, online retailers, M&S’s sales depend on online ordering, click and collect and a digital supply chain. When those went down, the business lost revenue fast, store stock became inconsistent and customer trust was hit.
What went well
Not everything was a failure. M&S and associated stakeholders did some things that limited the damage or at least prevented worse outcomes.
They spotted the attack early for instance, and they were transparent with customers about what data had been lost and what hadn’t, the status of online services and what to watch out for.
They also quarantined impacted systems, took some offline, and paused services to limit further spread.
What are the key lessons learned?
The M&S attack can help companies prepare for the worst and mitigate the risks. Here’s what you need to do to safeguard your business.
- Invest in social engineering defences: Because many attacks begin with human error make sure your staff are trained in what to beware of. Simulate social engineering attacks, strengthen identity verification and conduct phishing tests.
- Don’t overlook a third-party risk: Extend your staff training and awareness to your suppliers and partner companies or audit them to ensure they have it covered.
- Be ready to deploy your incident response plan: Invest in 24/7 monitoring so that you can identify a problem quickly, and ensure you have a pre-defined incident response plan which can be triggered the minute you spot suspicious behaviour.
- Ensure your systems are resilient and redundancy-ready: Ensure you have backups, fallbacks and redundant capacity for your critical systems; segment them so they can be isolated to avoid contamination; and have a plan for operating offline and relying on manual processes.
- Communicate and be transparent: Being open and honest with customers helped to safeguard M&S’s reputation.Ensure you communicate well, internally and externally.
- Have the right insurance: Ensure you have cyber insurance to cover losses and provide expert support. This is especially critical for small businesses that don’t have the resources of larger companies.
Be prepared
The M&S attack showed that having strong perimeter defences isn’t enough if a member of staff or contractor makes what seems like a small error of judgement.
It’s not just your security tech you need to worry about, human and organisational vulnerabilities can be just as costly and without sufficient segmentation or resiliency, the cascade effects of a cyber attack can be huge.
For businesses, the key is to anticipate the threat; invest in all layers of defence (technology, people, process); and build systems that can continue to function or recover quickly, when things go wrong.
