Marks & Spencer Halts Online Orders Amid Cyberattack Fallout

Marks & Spencer has halted all orders via its website and app as retailers grapple with the aftermath of a cyberattack that began on Monday.

The company expressed regret to customers for “the inconvenience,” stating that the suspension of digital orders is “part of an aggressive management strategy for cyber incidents.”

“Our experienced team is collaborating with key cyber experts, and we are diligently working to restore online and app shopping,” he remarked.

Customers can still browse online and make purchases at physical stores using cash or credit cards.

The website’s shutdown follows several days of problems at retail locations, where contactless payments and online order collections were severely affected since Monday. Contactless payments resumed late Thursday.

Customers with existing online orders can collect them in-store once they receive confirmation, but placing new orders is not permitted. M&S clarified that customers do not need to take any action and assured that their details were not accessed.

The retailer’s shares have dropped by as much as 4%, following a 2.3% decline at Friday’s close, marking a significant fall within the FTSE 100.

Only about one-third of M&S’ clothing and home goods sales occur online, and the order suspension comes just before an anticipated heatwave, likely to increase demand for clothing and outdoor entertainment gear during busy weekends.

The cyber incident initiated on Monday impacted contactless payments and click-and-collect orders at stores throughout the UK. Notably, a separate technical issue affected only contactless payments during the busy Easter weekend.

M&S has enlisted cybersecurity specialists to aid in investigating and managing the situation, implementing measures to bolster network security and continue serving customers effectively.

Security experts cautioned shoppers to be vigilant against scammers exploiting high-profile cases.

Nicholas, head of commercial content at Retail Economics, stated, “The Marks & Spencer cyberattacks serve as a reminder that no retailer, regardless of its establishment or digital sophistication, is safe from the growing threat of cybercrime.”

“While M&S is bearing the impact of this specific attack, it’s important to note that this isn’t an isolated incident. Cyberattacks represent a systemic risk facing the retail sector as a whole.”

The cyber incidents targeting M&S have occurred alongside a series of similar events in recent years. Last September, Transport for London had to shut down several online services due to a cyber attack.

In 2023, Royal Mail was compelled to halt international parcel and letter dispatches after a cyber attack caused significant disruption to its services, while WH Smith suffered an attack that illegally accessed data, including personal information of current and former employees, occurring less than a year after a cyber incident on their Funky Pigeon website led to a week-long order suspension.

In 2022, the Guardian requested many staff members to work from home following a ransomware attack that compromised the personal data of UK employees.

According to a government report, in 2022, two out of five UK businesses reported experiencing cybersecurity breaches or attacks within the prior year.