Overview
- M&S has fully reinstated its click and collect service for clothing, home and beauty products after a nearly four-month suspension following the April ransomware attack.
- The service return marks completion of M&S’s phased recovery plan, which resumed home delivery in June and restored website browsing and other online offerings in July.
- M&S forecasts the breach will cost about £300 million in lost operating profit for 2025/26 and expects to halve the impact through insurance claims and cost controls.
- Collaboration with cybersecurity experts, the National Cyber Security Centre and UK law enforcement has led to four arrests of individuals linked to suspected DragonForce and Scattered Spider hackers.
- With digital services restored, M&S is now focusing on concluding regulatory investigations and strengthening cybersecurity to prevent future breaches.