Analysis of the 2025 Marks & Spencer Ransomware Attack

Since digital technology is being used more and more, cybersecurity has become a major issue for large businesses. Stores like Marks & Spencer (M&S) make use of digital systems for online shopping, for payments, for managing their stock, for logistics and for providing customer services. As these systems are closely linked, a cyberattack can have an impact not only on the computer systems but also on normal business operations. In April 2025 M&S had a serious cyber incident which disrupted a number of its services. As a precaution the company put some of its systems offline and temporarily halted online orders. The disruption also had an effect on warehouse and ordering procedures, so the company was forced to resort to manual methods in order to carry on with its operations. M&S later stated that some personal customer information had been obtained, even though usable details of payment cards and account passwords were not included. This case study looks at the M&S cyberattack, with emphasis on the nature of the incident, its possible technical features, the effect on business operations and on customers, and the actions taken by the company. It also considers the financial impact of the incident and the kind of cybersecurity measures that can help organisations prepare for similar attacks. M&S first estimated that the incident could reduce its operating profit for the 2025/26 financial year by about £300 million before taking into account mitigation, insurance and trading measures. The purpose of the study is to demonstrate that cybersecurity should be viewed not just as an IT issue but also as an important element of business continuity and organisational risk management.