Marks & Spencer (M&S) has suspended online orders amid a major cyber attack, leaving customers and investors unsettled.
The retailer confirmed it was dealing with a “cyber incident” earlier this week, following mounting customer complaints over the weekend. By Friday, M&S had officially paused all orders via its website and apps, covering both food deliveries and clothing, and announced full refunds for purchases made on Friday.
Following the news, the company’s shares fell by 5% before managing a slight recovery. As of Saturday morning, the suspension of online orders remained firmly in place.
In a post on X, M&S said: “We are truly sorry for this inconvenience. Our experienced team, supported by leading cyber experts, is working extremely hard to restart online and app shopping. We are incredibly grateful to our customers, colleagues and partners for their understanding and support.”
The company reassured customers that physical stores remain open and trading, despite the online chaos.
Persistent Technical Issues
Prior to suspending online orders, M&S was grappling with issues affecting contactless payments, Click & Collect services, and the use of gift cards.
Responding to customer queries on social media, the retailer admitted that these problems persist. “Gift cards, e-gift cards and credit receipts can’t currently be used as a payment method in store or online,” M&S replied to one customer.
However, those who have received a collection email are still able to pick up their items in store.
“We’re holding all parcels in store until further notice, so there’s no risk of it being sent back,” M&S explained.
Customer Frustration Mounts
Not everyone has been satisfied with M&S’s handling of the situation. One frustrated customer wrote on X: “After being told yesterday in the evening the problem with gift cards was sorted, went in store today and was sent away again.”
It marked the fourth consecutive day the customer had been unable to use an M&S gift card. While some criticised the firm’s communication, others praised the in-store staff for maintaining professionalism during difficult circumstances.
Still, many shoppers are left with unanswered questions about existing orders, returns, and refunds. Worth noting — Ocado, the online grocer selling M&S food products, remains unaffected as it operates on a separate system.
Cybersecurity Investigation Underway
The Information Commissioner’s Office confirmed M&S has reported the incident and is currently “assessing the information provided.”
The National Cyber Security Centre (NCSC) and the National Crime Agency are both involved in supporting the retailer through the investigation.
M&S described the decision to suspend online operations as part of “proactive management” in a statement to investors on Friday.
“The M&S team – supported by leading experts – is working extremely hard to restore online operations and continue to serve customers well,” it said.
Expert Warnings Over Financial Impact
Industry experts are warning of potentially significant financial consequences for M&S.
Nathaniel Jones, Vice-President of Security and AI Strategy at Darktrace, highlighted the broader risks: “The cascading impact these attacks can have on revenue streams… demonstrates how quickly cyber incidents can cripple retail operations across both digital and physical channels.”
Meanwhile, William Wright from Closed Door Security noted the financial stakes involved.
“Data shows almost a quarter of the store’s sales happen online, so no matter how long this pause is put in place, it will hurt M&S financially,” he said.
M&S now joins a growing list of big brands facing cyber woes. Morrisons, for instance, suffered a collapse in its Christmas deliveries last year. Meanwhile, banking outages caused chaos for customers earlier this year.
As M&S battles to restore its online services, customers and investors alike are watching closely. With the retailer’s online revenue taking a substantial hit, the road to recovery could be longer than anticipated.
Meanwhile, the spotlight remains firmly on how M&S manages its communication and rebuilds trust in the aftermath.
