Headlines

M&S will be over the worst of cyberattack impact by August, says CEO

Published by Global Banking & Finance Review

Posted on July 1, 2025

2 min read

· Last updated: January 23, 2026

Add as preferred source on Google
M&S will be over the worst of cyberattack impact by August, says CEO
Global Banking & Finance Awards 2026 — Call for Entries

LONDON (Reuters) -Most of the impact of the cyberattack which hit Marks & Spencer <M&S> in April will be behind it by August, Chief Executive Stuart Machin told shareholders at the retailer's annual

M&S will be over the worst of cyberattack impact by August, says CEO

By Sarah Young

LONDON (Reuters) -Marks & Spencer will be over the worst of the fallout from this year's damaging cyberattack by August, its CEO said on Tuesday as shareholders questioned the British retailer over whether it could have prevented the incident that caused a 300 million pound ($413 million) hit to profit.

The April attack on M&S, one of the biggest names on UK shopping streets, forced the group to close its online store for nearly seven weeks and led to empty shelves at its shops during May as automated stock systems were shut down.

"I'm really hoping by August, the majority of this is behind us," CEO Stuart Machin told shareholders at the company's annual meeting, their first chance to press the company publicly on the attack and its consequences.

Asked whether the attack could have been stopped, Chairman Archie Norman said there was always something that could be done and M&S continued to examine the incident.

Machin emphasised how M&S had quadrupled investment in cyber security and trebled the number of colleagues working on protecting its systems over the 12 months before the attack.

"I'm glad we invested then. I'm glad we continue to invest," he said.

One investor asked whether Machin's bonus should be cut because the cyberattack happened under his watch. Norman said the group's philosophy was to adjust incentive pay to reflect shareholder rewards but it was too early to say how that might look this year.

Machin's total pay package in the company's past financial year jumped 39% to 7.1 million pounds.

He said the focus now was on recovery and strengthening training to help staff guard against the type of social engineering that allowed hackers into M&S systems via a third-party contractor.

M&S's online shop is still only partially open but is expected to be fully restored within the next four weeks, Machin said. The company had warned in May that there would be disruption to online services until July.

Internal systems including automation at its Donington logistics warehouse are expected to be back up and running by August, Machin said.

($1 = 0.7272 pounds)

(Reporting by Sarah YoungEditing by David Goodman)

Key Takeaways

  • M&S expects to recover from cyberattack impact by August.
  • The attack caused a £300 million hit to profits.
  • M&S has increased cybersecurity investments significantly.
  • Online store disruptions are expected to end by July.
  • Internal systems to be fully operational by August.

Frequently Asked Questions

When does M&S expect to recover from the cyberattack?
CEO Stuart Machin stated that he hopes the majority of the fallout from the cyberattack will be behind M&S by August.
What measures has M&S taken in response to the cyberattack?
M&S has quadrupled its investment in cyber security and increased the number of colleagues working on system protection.
How long was M&S's online store closed due to the cyberattack?
The online store was forced to close for nearly seven weeks following the April cyberattack.
What is the current status of M&S's online shop?
As of now, M&S's online shop is only partially open but is expected to be fully restored within the next four weeks.
What did shareholders question during the annual meeting?
Shareholders questioned the impact of the cyberattack and whether CEO Machin's bonus should be adjusted due to the incident.

Tags

Related Articles

More from Headlines

Explore more articles in the Headlines category