2025Data breach
Marks and Spencer and UK retail cyber attacks
April to May 2025
Attacks on three UK retailers in spring 2025 disrupted operations; Marks and Spencer paused online orders for weeks. In July 2025 the National Crime Agency arrested four people on suspicion of Computer Misuse Act offences, blackmail, money laundering and participating in an organised crime group.
- Victim
- Marks and Spencer, the Co-op and Harrods
- Sector
- Retail
- Public attribution
- In July 2025 the UK National Crime Agency arrested four people over the attacks; the NCA's announcement did not name a group.
Impact
Marks and Spencer estimated an impact of around 300 million pounds on group operating profit for 2025/26 before mitigations, as reported by The Record.
Root cause
Full technical details have not been published in the cited sources.
Lessons learned: the controls it teaches
- Verify identity strongly before help-desk password and MFA resets, including at outsourced service desks.
- Hold third parties with privileged access to the same security standards as staff.
- Plan for weeks of degraded operations, including manual fallback for online sales and logistics.