Sarah Butler
4 min read
M&S customers have been ‘unwavering in their support’ since the cyber-attack, Stuart Machin said.</span><span>Photograph: Neil Hall/EPA</span>" height="768" loading="eager" src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///ywAAAAAAQABAAACAUwAOw==" width="960">
Marks & Spencer has said it will take an estimated £300m hit to profits this year from a damaging cyber-attack that it expects to disrupt its online business into July.
Its chief executive, Stuart Machin, confirmed that “threat actors” had gained access to the retailer’s systems via one of M&S’s contractors using “social engineering” techniques – such as posing as a staff member to fool a help desk. He said the hack was not down to a weakness in its IT systems.
“They used heavily sophisticated techniques,” he said, adding that the incursion had been quickly spotted over the Easter weekend and the business was ready with a plan after a simulation exercise of an attack last year.
M&S revealed more details of the cyber-incident alongside its annual trading figures, which showed underlying profits rose by a better-than-expected 22% to £876m in the year to 30 March.
The company said it had more than £400m of net funds in the bank so that it had been “in the best financial health we’ve been in 30 years” before the hackers hit. It said it aimed to halve the financial impact of the attack to about £150m through insurance, cost reductions and other actions.
Machin said he expected the business to “recover at pace” from the disruption, with its website expected to reopen “within weeks” and likely to begin selling in all product categories before July. “If anything, the incident allows us to accelerate the pace of change as we draw a line and move on,” he said.
He dismissed fears of a hit to shoppers’ confidence in the business, saying the retailer had been “very transparent” about the problem and had passed on information swiftly.
Machin said M&S’s food was now selling well but that clothing and homeware sales in stores were “softer than we would like”, having been disrupted by the closure of the website.
He acknowledged that £300m – about two-thirds of which is down to lost clothing sales, according to analysts – “does sound like a big number” but described the hit as a “one-off” that was “not significant” to the business as a whole.
Machin said there were no plans to offset the cost with job cuts or to reduce store refurbishments or openings, with nine new food stores and two full-line outlets planned this year.
The business is bringing forward IT investment and will carry out two years of work on updating its systems in six months, partly aided by the forced shutdown of its website and online distribution centre, which made bringing in new technology simpler.
Analysts said they expected to cut profit forecasts for this year by at least 10%.
