The Marks & Spencer cyberattack: six weeks without online sales, and the lessons for e-commerce

In spring 2025, a cyberattack took Marks & Spencer’s online store offline for about six weeks, at an estimated cost of £300m. What it teaches any brand that sells online.

In late April 2025, the British retailer Marks & Spencer was hit by a major cyberattack. It had to suspend orders on its website and app, which only resumed around 21 May, roughly six weeks later.

The consequences

• Online sales halted for several weeks.
• Empty shelves in some stores as the supply chain was disrupted.
• An impact the company estimated at about £300m on operating profit, before insurance and mitigation.
• A sharp fall in market value in the days that followed.

How the attackers got in

According to press reports, access was obtained through a contractor using social engineering: persuading someone, often a help desk, to reset an account. The group known as Scattered Spider was widely cited, without official confirmation.

Lessons for an online store

• Make password resets strict: solid identity checks, never on a phone call alone.
• Give contractors only the access they need, and remove it when their work ends.
• Keep isolated backups and a plan to bring the store back online quickly.
• Plan a fallback: take orders by WhatsApp or phone if the site is down.

A matter of continuity, not just security

For a brand that sells online, every day offline costs sales and trust. Security should be prepared like business continuity: who does what, and how you keep serving customers during the incident.

The most exploited weakness is not always technical: it is often a well-prepared phone call.

Sources: Marks & Spencer statements and UK press (Al Jazeera, LBC, City AM), May 2025.

Want a sturdier online store? Tell us about your project through our estimate form: we will reply with an estimate and the next steps.