Case study · Retail
Marks & Spencer: weeks without online sales
UK, 2025. A cyberattack halts online orders and forces stores onto manual processes.
In one sentenceThe attackers came in through a third party's help desk: your password-reset process is a front door.
- Sector
- Retail
- Country
- United Kingdom
- Date
- April 2025
- Duration
- Online orders paused from 25 April to 10 June
- Estimated impact
- About £300m on annual profit, before insurance
Analysis based solely on public information. FZ Consultation was not involved in this incident and has no affiliation with the organizations named.
What happened
- Around 21 April 2025
Over the Easter weekend, contactless payments and click and collect are disrupted.
- 22 April 2025
The company discloses a cyber incident to the London Stock Exchange.
- 25 April 2025
Website and app orders are paused. Stores stay open, with manual processes and stock shortages.
- 13 May 2025
The company confirms theft of customer personal data, with no payment card details or passwords.
- 21 May 2025
The impact is estimated at about £300m on the year's profit.
- 10 June 2025
Online orders for delivery resume; click and collect returns only weeks later.
What went wrong
According to the public sources listed below.
People as the way in
According to published reports, the attackers gained access by social engineering a third-party IT help desk.
Undetected presence
Reports indicate initial access may date back to February 2025, several weeks before the visible attack.
Tightly coupled systems
Orders, payments, stock and logistics were hit together, which made recovery long and gradual.
Lessons for your organization
- 1
Protect the help desk
Strong identity checks before any password or MFA reset, including at service providers.
Prepare: recovery that holds - 2
Plan for degraded mode
Prepared manual procedures for stores, stock and the supply chain.
Know: measure what stopping would cost - 3
Rehearse staged recovery
Define the order in which services come back and rehearse it before an incident.
Prove: rehearse before the real day
Check on Monday morning
Three questions to put to your own organization this week. If you cannot answer one of them in five minutes, that is your first task.
- What does your help desk, and your provider's, check before resetting a password or a second factor?
- If orders, payments and stock failed together, what is the manual procedure, and who has tried it?
- In what order would your services come back, and is that order written down?
Sources
More case studies
- AWS us-east-1: one empty DNS record, a day of cascading failuresWorldwide, October 2025. A race condition in DynamoDB's DNS automation leaves a region without an address, and many services fall with it.
- Jaguar Land Rover: weeks of idle factories and a state-backed loanUK, 2025. A cyberattack stops production for weeks and reaches over 5,000 organisations across the supply chain.
- Collins Aerospace: one check-in system, four airports on paperEurope, September 2025. Ransomware hits a shared check-in system and forces Heathrow, Brussels, Berlin and Dublin onto manual processes.