2025-04-17 (incident) · GB · Marks & Spencer

Marks & Spencer cyber attack via third-party impersonation, 2025

Disclosed by the affected organisation.

M&S chairman Archie Norman told a UK parliamentary sub-committee that attackers first got in on 17 April 2025 through a sophisticated impersonation that involved a third party, and BleepingComputer reported he said they tricked a third party into resetting an employee's password. M&S paused online orders and in May estimated a £300 million hit to operating profit before mitigation and insurance. The NCA arrested four people in July 2025 over the M&S, Co-op and Harrods attacks.

£300M (estimate, about $402M; M&S's expected impact on 2025/26 operating profit before cost mitigation, insurance and trading actions; US dollar figure as converted by The Record ($402 million).)

Timeline

1. 2025-04-17 Attackers gain initial entry, according to the M&S chairman's evidence to MPs.
2. 2025-04-22 M&S announces it has been managing a cyber incident; as part of its response it later pauses orders through its UK and Ireland websites and apps.
3. 2025-05-21 M&S full-year results estimate a cyber incident impact of about £300 million on 2025/26 operating profit.
4. 2025-07-08 Chairman Archie Norman tells a parliamentary sub-committee that the entry came through sophisticated impersonation involving a third party.
5. 2025-07-10 The NCA arrests four people on suspicion of offences linked to the M&S, Co-op and Harrods attacks.

Lessons

• Apply your identity verification rules to every third party that can reset your staff's passwords, and test them.
• Assume attackers will arrive with real personal details of the employee they impersonate; details alone are not proof of identity.
• Report to the NCSC and law enforcement early; M&S reported to the NCSC and the ICO.

Scam types: Help desk password and MFA reset impersonation

Sources

1. Marks and Spencer Group plc: Full year results for the 52 weeks ended 29 March 2025 (Company disclosure, primary, accessed 2026-09-24)
2. NCA: Retail cyber attacks: NCA arrest four for attacks on M&S, Co-op and Harrods (Law enforcement, primary, accessed 2026-09-24)
3. BleepingComputer: M&S confirms social engineering led to massive ransomware attack (News report, secondary, accessed 2026-09-24)
4. The Record: M&S says cyberattack will hit profits by £300 million (News report, secondary, accessed 2026-09-24)