DriversRecommendedOutdated drivers can make a good PC feel brokenScan driver issues before chasing fixes manually.Scan NowHalloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsPC HealthRecommendedCrashes, freezes, slowdowns? Check your PC nowSpot repairable issues before they interrupt work.Check PC×
Skip to the guide
THE FINANCEBASE List yours

Guide

More than a year on from the M&S cyber attack: what did we learn?

By TheFinanceBase Team 8 min read

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The M&S cyber attack was not simply a website outage. It disrupted online orders, click-and-collect, in-store ordering, warehouse management, replenishment and stock flow. More than a year later, M&S had restored most systems, but its 2026 results showed that the financial consequences continued long after customer-facing services returned.

The clearest lesson is that cyber resilience is a business-continuity capability. The public record confirms the operational and financial impact, but it does not establish the attackers’ identity, the complete entry path, whether a ransom was demanded or paid, or whether a particular supplier was responsible.

As an Amazon Associate I earn from qualifying purchases.

The short version

M&S announced the cyber incident on 22 April 2025. It subsequently took some systems offline, paused online orders and disconnected warehouse-management systems. That protected the wider business but disrupted several connected retail operations.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

By the summer of 2025, M&S said customer-facing systems had been restored. In its September update, it said practically all operational systems had been recovered, although fashion recovery was slower because of systems complexity and stock-flow problems. Its results for the 52 weeks ended 28 March 2026 recorded £131.3 million of incident-related costs and £100 million of related insurance proceeds.

#1 Best Overall
Hard Drive Reader USB 3.0 & Type C to SATA IDE Adapter, Data Transfer Kit
  • Professional Technical Support: Dedicated to helping customers solve usage problems. Product instructions are detailed, covering the operation steps and unrecognized, read and other problems. Vorodcip professional team is ready to answer your questions.(Please check the product manual for details before use)
  • Universal USB 3.0 Hard Drive Adapter: SATA IDE to usb 3.0 adapter support 2.5"/3.5" SATA HDD/SSD, 2.5"/3.5" IDE, SATA/IDE Internal Blu-ray drive. Hard drive converter is retrieve old files, backup, cloning and data recovery device tools.
  • High-speed Transmission: The hard drive connector is equipped with a USB-C to USB adapter, supporting USB and USB-C port devices. The maximum transmission rates of SATA and IDE interfaces are 5gbps and 133Mbps respectively(based on actual usage).
  • Plug & Play: Universal hard drive adapter does not require additional drivers. On/Off power switch for hard drives protection. It supports drvies with a capacity of maximum 20TB.
  • Wide Compatibility: Compatible with 2.5"/3.5" HDD/SSD, 2.5"/3.5" IDE. Hard drive reader to usb adapters support Windows XP/7/8.1/8/10, Mac OS 10, Linux, Vista etc.

This was a significant recovery, not a cost-free bounce-back. Adjusted profit before tax fell 23.8% to £671.4 million, while Fashion, Home & Beauty sales fell 7.7%. Food sales rose 7.0%, but profitability was affected by markdowns and waste during the disruption.

For customers, M&S said some personal data may have been taken, including contact details, date of birth, online order history, household information and masked payment-card details. It said usable payment details and account passwords were not included.

What happened and when?

Date What M&S reported
22 April 2025 M&S announced that it was managing a cyber incident and had engaged external cyber-security specialists and relevant authorities.
23 April 2025 Some processes were moved offline. Contactless payments were unavailable and click-and-collect collection was paused.
25 April 2025 M&S paused orders through its websites and apps, while products remained available to browse.
Summer 2025 M&S said customer-facing systems had been restored.
September 2025 M&S said practically all operational systems had been recovered, although fashion recovery remained slower because of complexity and stock-flow disruption.
20 May 2026 M&S reported the full-year financial effects and described the year as two halves: a severely disrupted first half followed by second-half profit growth.

These dates come from M&S’s operational update, its online-order announcement, its half-year results and its full-year results.

Why the outage was bigger than e-commerce

Customers could still shop in physical stores, which limited the damage. But a modern retailer’s website is only one part of a much larger operating system.

M&S said the incident led to the disconnection of warehouse-management systems. That affected online orders, click-and-collect and in-store ordering. Manual processes were used for forecasting, ordering and replenishment, but those workarounds could not fully replace integrated systems.

Rank #2
Unitek USB 3.0 to SATA IDE Hard Drive Adapter, for 2.5/3.5" HDD/SSD
  • 【Dual-Drive Simultaneous Use & Wide Compatibility】This hard drive adapter supports connecting one IDE drive and one SATA drive at the same time. It works with 2.5"/3.5" IDE HDDs, 2.5"/3.5" SATA HDDs and SSDs, as well as optical drives like CD-ROM, DVD-ROM, and DVD-RW. The dual-head IDE connector (40-pin and 44-pin) and a SATA III port give you maximum flexibility for data migration, backup, or drive recovery.
  • 【High-Speed Transfer with USB 3.0 & SATA III】Experience data transfer rates up to 6Gbps through the SATA III interface, with USB 3.0 connectivity (backward compatible with USB 2.0/1.1). Please ensure your computer has a USB-A port, as this hard drive reader uses a USB-A connection only.
  • 【Stable Power Supply for Reliable Operation】The included 12V/2A power adapter is essential for stable performance—please always connect it when using this IDE to USB adapter, especially when accessing two drives simultaneously. The 4-pin power cable is designed specifically for 3.5" IDE drives (not required for SATA drives).
  • 【Plug-and-Play with User-Friendly Design】No driver installation required. Supports hot-swapping for quick drive changes, and features an On/Off switch to protect your hard drives from unnecessary wear. The LED indicator clearly shows power and activity status.
  • 【What's Included & Support】You'll receive the USB 3.0 to IDE+SATA adapter, a USB 3.0 data cable, a 4-pin power cable, a 12V/2A power adapter, and our 24/7 dedicated email support.

The result was a stock-flow problem. Products were not simply unavailable because a website was offline; the systems that help determine what stock is available, where it is located and how it moves through the business were also affected. M&S later referred to excess seasonal stock, markdowns and slower recovery in fashion, home and beauty.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

This distinction matters for investors, employees and customers. A retailer can restore its customer website while still struggling with stock accuracy, fulfilment, replenishment and product availability. Technical recovery and commercial recovery are not the same event.

How much did the attack cost?

M&S’s latest reported figures are more useful than early media estimates made while the incident was still developing. For the 52 weeks ended 28 March 2026, the company reported:

  • £131.3 million of incident-related costs included in adjusting items.
  • £100 million of insurance proceeds relating to the incident.
  • £671.4 million of adjusted profit before tax, down 23.8%.
  • £364.6 million of statutory profit before tax, down 28.8%.
  • 7.7% lower Fashion, Home & Beauty sales.
  • 7.0% higher Food sales.
  • 4.1% year-on-year growth in second-half adjusted profit.

The £131.3 million figure is M&S’s disclosed accounting measure of incident-related costs. It is not necessarily the total economic cost. Lost sales, supplier disruption, customer inconvenience, employee time, reputational effects, recovery investment and future commercial effects may not be captured by that one number.

Nor should the £100 million insurance receipt be treated as proof that the net loss was only £31.3 million. Insurance proceeds, accounting treatment, lost revenue and indirect costs answer different questions.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What customer data may have been involved?

M&S’s customer cyber update said some personal customer data had been taken, although there was no evidence that it had been shared. The potentially affected categories included:

Rank #3
Data Recovery Stick for Windows Data Recovery Software – Photos, Files
  • The Data Recovery Stick requires no technical skills — simply plug it into your Windows computer, click Start, and the software automatically begins scanning and recovering lost files within minutes. Compatible with Windows Vista, 7, 8, 10, & 11, it's designed to be a reliable first step when accidental deletion occurs.
  • Recover photos (JPG, BMP, PNG, TIFF), Microsoft Office documents (Word, Excel, PowerPoint, Publisher, Access), Open Office files, MP3 music files, PDFs, RTF documents, AutoCAD files, and HTML web pages. Whether it's personal memories or critical business files, the Data Recovery Stick covers the file types that matter most.
  • Works with hard drives, USB drives, SD cards, memory sticks, and other common storage formats that use FAT or NTFS file systems — making it a single solution for hard drive recovery, USB drive recovery, SD card recovery, and more. Note: a media reader is required for micro SD cards and some mass storage devices.
  • No Installation Required - The Data Recovery Stick runs entirely from the USB drive with no software installation on your computer — helping prevent new data from overwriting the files you're trying to recover. This also makes it ideal for use across multiple computers or in emergency situations where installation isn't practical.
  • Use the Data Recovery Stick on as many computers as often as needed — simply clear the recovered data between uses to free up storage space. Software updates keep the tool compatible with newer systems and devices, backed by 25+ years of data software expertise from Paraben Consumer Software.
  • Names, email addresses, postal addresses and telephone numbers.
  • Dates of birth.
  • Online order history.
  • Household information.
  • Masked payment-card details.
  • Certain customer-reference numbers linked to M&S credit cards or Sparks Pay.

M&S said the data did not include usable payment details or account passwords. It also said it does not hold full payment-card details on its systems.

That does not mean the information is harmless. Combined personal data can support convincing phishing, fraudulent delivery or refund messages, impersonation and password-reset attempts. Order history can give a scammer a plausible reason to contact someone.

The accurate formulation is therefore not “customers’ payment data was stolen”. It is that M&S said usable payment details were not included, while masked card information and other personal data could have been taken. The ICO’s statement on the retailer incidents provides broader regulatory context.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What did M&S do well?

The public record supports a measured assessment rather than a blanket verdict on the response.

  • Early acknowledgement: M&S disclosed the incident and said it had engaged external cyber-security experts.
  • Containment: Taking systems offline and moving processes offline created immediate commercial pain but helped limit the threat’s potential spread.
  • Authority notification: M&S reported working with relevant authorities, including the NCSC and ICO.
  • Continuity measures: Manual processes helped stores and other operations continue while systems were unavailable.
  • Customer communication: M&S maintained a public cyber-update page and warned customers about phishing and impersonation.
  • Recovery: Customer-facing systems and most operational systems were progressively restored.
  • Financial capacity: M&S’s balance sheet and liquidity position helped it absorb the disruption without abandoning its broader transformation programme.

These actions show a response designed around containment and continuity. They do not, by themselves, prove that every security control worked well or that the original compromise could have been prevented.

What appears to have gone badly?

M&S’s disclosures also show the consequences of tightly coupled retail systems:

Rank #4
USB 3.0 to SATA IDE Hard Drive Reader, YINNCEEN External Hard Drive Ultra Recovery Converter Universal Hard Drive Adapter Kit for 2.5/3.5 HDD/SSD Hard Drive Disk, Include 12V/2A Power Adapter
  • Universal Hard Drive Adapter: SATA IDE to USB adapter allows connect your SATA / IDE device to computer as an external hard drive via USB 3.0. Compatible with 2.5"/3.5" IDE/SATA hard drives. This is a tool to duplicate, copy, backup, or transfer large amounts of data from one drive to another
  • Transfer Rate up to 5Gbps: SATA to USB 3.0 adapter supports super speed USB 3.0 enables data transfer rates of up to 5Gbps, backward compatible with USB 2.0(high-speed 480 Mbps) / USB 1.1(full-speed 12 Mbps) standards, The actual transmission speed subjects to the setting of the device connected
  • Wide Compatibility: Hard drive to USB adapter support Operate Systems: Support Windows XP/Vista/7/ 8/8.1/10, Mac OS 10 or higher, Linux. Compact body design, Support Plug, and play & hot swap, On/Off power Switch for Hard drives protection
  • Support Hard Drives Capacity up to 6TB: Hard drive adapter has a SATA III connector and two IDE connectors (40pin and 44pin). we Provide a 4pin power cable for a 3.5" IDE drive, Tips: Some IDE hard drive is old, you need to set a jumper to turn on the disk, set the master disk and the slave disk
  • Included 12V 2A Power Supply: USB 3.0 to IDE SATA adapter included 12V2A AC power supply, for power up the 5V/12V IDE devices usage, ensures SATA HDD can be connected well. 4pin power cable is designed for a 3.5’’ IDE drive; LED light shows power and activity status
  • Disconnecting warehouse systems affected several customer channels at once.
  • Manual workarounds could preserve some activity but could not fully replace integrated systems.
  • Recovery was slower where system complexity and stock-flow dependencies were greatest.
  • Some file systems were not recoverable and had to be rebuilt, according to the 2026 annual report.
  • Markdowns, waste, lost online sales and recovery costs extended the financial impact beyond the initial outage.
  • As at 19 May 2026, M&S said it continued to cooperate with the ICO and other relevant regulators.

These are known outcomes, not proof of negligence. The public disclosures do not establish the exact attack path, the initial access method, the identity of the attackers, whether a ransom was demanded or paid, or whether a supplier was responsible.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Five lessons for retailers and business leaders

1. Protect identity and privileged access

Retailers should require phishing-resistant multifactor authentication for administrators and other high-value users, minimise standing privileges and monitor unusual password resets, help-desk activity and remote access.

The M&S disclosures do not confirm that identity compromise was the entry point. These are controls relevant to the threat class, not a reconstruction of this attack.

2. Map suppliers and revoke access quickly

Organisations need an up-to-date map of suppliers with access to identity, warehouse, logistics, payment and customer systems. Contracts should require rapid incident notification, and businesses should regularly test whether supplier access can be suspended without disrupting essential recovery.

The NCSC’s guidance emphasises incident management, reporting and recovery. A supplier’s resilience also matters: can it operate safely when the retailer’s systems are unavailable?

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

3. Test recovery, not just backups

“We have backups” is not the same as “we can resume retail”. Businesses should maintain isolated or offline backups and test restoration of individual files, applications and complete business services.

Best Value
ULXUUUN Hard Drive Reader USB 3.0 to SATA IDE Adapter, IDE SATA to USB + Type C External Data Recovery Converter Kit for Universal 2.5 3.5 HDD SSD Hard Drive Disk, with 12V/2A Power Adapter
  • UNIVERSAL HARD DRIVE READER: SATA and IDE to USB 3.0 adapter supports 2.5"/3.5" HDD/SSD, 2.5"/3.5" IDE, 5.25" DVD-ROM, CD-ROM, CD-RW, DVD-RW, DVD + RW optical drive. With dual-head IDE connector (40pin and 44pin) plus one SATA III connector, lt's compatible with 2.5"/3.5" DE/SATA hard drives
  • 5G BPS HIGH SPEED TRANSFER: This IDE to SATA Hard Drive adapter is designed with a USB 3.0 port that supports high-speed, enabling data transfer rates of up to 5Gbps. Data transfer process is exceptionally simple and effortless. Additionally, our ultra recovery converter maintains backward compatibility with USB 2.0 / USB 1.1
  • HUMANIZED DESIGN: This ide hard drive converter adopts a 2-IN-1 (USB+USB-C port)designed, USB to USB-C adapter that plugs into the USB port to match your laptop and is not limited by the computer model. It also supports hot swapping, allowing you to connect or disconnect drives without having to restart your computer. On/off switch for HDD protection and the LED light indicates power and activity status
  • STABLE POWER SUPPLY: Our USB 3.0 to IDE SATA adapter comes with a 12V2A power adapter, for 3.5" IDE drivers and old SATA HDD, you need to connect this power adapter and 4-pin power cable for a better connection. If you want to use old IDE hard drive, please set a jumper and set it to "slave". The actual transmission speed depends on the Settings of the connected device
  • WHAT YOU WILL GET: Package included: Hard driver readerx1, 4-pin power cablex1, 12V/2A power adapterx1, USB C and USB 2-In-1 cablex1, manualx1. Tips: This IDE to USB adapter default master is a 2.5" IDE hard drive, if your hard drive is new, please go to "Disk Management" to initialize it first so that the hard drive can be recognized

Recovery plans should include clean-room rebuilds for systems that cannot be trusted or recovered. They should also document dependencies: payment, ordering, warehouse management, replenishment, customer support, payroll and communications may rely on different systems.

4. Design for degraded operation

Integrated systems create efficiency, but they can also create a large blast radius. Retailers should identify which stores, warehouses and fulfilment processes can operate in a limited mode if central systems are unavailable.

Manual procedures should be documented, resourced and exercised. A procedure that exists only in a policy document is not a tested fallback.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

5. Put cyber resilience at board level

Boards should ask how long critical operations can run offline, how quickly systems can be rebuilt without the compromised environment and whether recovery targets have been tested in practice.

Exercises should involve operations, finance, legal, communications, HR, suppliers and the board. Cybersecurity should be measured by the organisation’s ability to contain, continue, recover, protect customers and learn—not only by the number of tools deployed before an incident.

The trade-offs leaders must plan for

  • Containment versus continuity: taking systems offline may prevent a wider compromise but create immediate trading disruption.
  • Centralisation versus segmentation: integrated platforms improve efficiency but can increase the blast radius of a failure.
  • Automation versus manual fallback: automation is efficient, but manual alternatives are essential during severe outages.
  • Recovery speed versus forensic integrity: restoring quickly can overwrite evidence or reintroduce an attacker if the environment has not been made safe.
  • Insurance versus prevention: insurance can cushion financial loss but cannot restore lost stock flow, customer trust or operational time.

What customers should do

M&S warned customers about impersonation attempts and said it would not ask for passwords or personal account information. Customers should:

  • Treat unsolicited M&S-related emails, texts and calls cautiously.
  • Check messages through the official M&S website or app rather than clicking links.
  • Never provide passwords, usernames or payment information in response to an unexpected message.
  • Use unique passwords, particularly for email accounts, and enable multifactor authentication where available.
  • Monitor bank, card and other accounts for suspicious activity.
  • Report suspected fraud through the appropriate UK reporting channels.

What remains unresolved?

M&S’s public updates provide a credible account of the business impact, but they do not answer every technical question. The following should not be presented as established fact without a primary confirmation:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • The identity of the attackers.
  • A specific criminal group or ransomware classification.
  • The exact initial access route.
  • A particular supplier as the source of the intrusion.
  • Whether a ransom was demanded or paid.
  • The final regulatory outcome.
  • The full value of reputational damage or lost future sales.

That uncertainty is important. Attribution may attract attention, but the strongest verified lesson is about operational dependency: a cyber incident can become a retail supply-and-fulfilment crisis even when physical stores remain open.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a comment

Your email address will not be published. Required fields are marked *

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More guides

Recommended PC Tool
Recommended PC Tool
PC Slower Than It Used to Be?Free scan - under a minute
Crashes, No Sound, or Screen Glitches?Free driver scan

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.