Marks & Spencer Halts Online Orders Following Cyberattack, Raising Concerns About Retail Cybersecurity
LONDON — British retail giant Marks & Spencer (M&S) has suspended all online orders after a cyberattack crippled its systems, the company announced friday. The outage, which began impacting customers last weekend, has forced the retailer to halt online and app-based shopping, including both food deliveries and clothing purchases. M&S confirmed it will refund orders placed by customers on Friday.
“We are truly sorry for this inconvenience,” the retailer wrote in a post on X, formerly Twitter. “Our experienced team – supported by leading cyber experts – is working extremely hard to restart online and app shopping. We are incredibly grateful to our customers, colleagues and partners for their understanding and support.” The company emphasized that its physical stores remain open despite the ongoing online disruptions.
The cyber incident has affected various aspects of M&S’s operations, including contactless payments, click & Collect services, and the use of gift cards. “Gift cards,e-gift cards and credit receipts can’t currently be used as a payment method in store or online,” the company stated in a response to a customer on X. Though, customers who have received email notifications confirming their Click & Collect orders should still be able to pick up their items in-store. “We’re holding all parcels in store until further notice, so there’s no risk of it being sent back,” M&S assured customers.
The disruption has drawn criticism from some customers regarding the company’s communication and handling of the situation. One customer posted on X, complaining, “After being told yesterday in the evening the problem with gift cards was sorted, went in store today and was sent away again…. They said it was the fourth day in a row they had tried and failed to use their M&S gift card.”
Shares of M&S fell by 5% following the announcement of the online shutdown, highlighting the financial impact of the cyberattack.
Experts Weigh In on Potential Impact
Cybersecurity experts warn that the M&S incident underscores the vulnerability of retail businesses to cyberattacks, which can have a ripple effect across operations and revenue streams.
Nathaniel Jones, vice president of Security & AI Strategy at cybersecurity firm Darktrace, said M&S halting online sales shows “the cascading impact these attacks can have on revenue streams.” He further stated, “It demonstrates how quickly cyber incidents can cripple retail operations across both digital and physical channels.”
William Wright from cybersecurity firm closed Door Security believes the outage could have a “material impact” on the company. “Data shows almost a quarter of the store’s sales happen online, so no matter how long this pause is put in place, it will hurt M&S financially,” he explained.
U.S. Retailers on High Alert
The M&S cyberattack serves as a stark reminder to U.S. retailers of the growing threat landscape. In recent years, several major U.S. retailers have been targeted by cybercriminals, resulting in notable financial losses and reputational damage.
One notable example is the 2013 Target data breach, which compromised the personal and financial data of over 41 million customers. The breach cost Target an estimated $200 million in expenses, including legal settlements, credit monitoring services, and infrastructure upgrades.
More recently, in 2020, grocery chain Kroger suffered a data breach affecting employee information, including Social Security numbers and payroll data.The incident highlighted the importance of protecting sensitive employee information in addition to customer data.
The increasing sophistication of cyberattacks, coupled with the growing reliance on e-commerce, has prompted U.S. retailers to invest heavily in cybersecurity measures. These measures include implementing advanced threat detection systems, strengthening data encryption protocols, and conducting regular security awareness training for employees.
according to a 2024 study by the National Retail Federation (NRF), U.S. retailers spent an average of $3.1 million on cybersecurity in 2023, a 25% increase compared to the previous year.
Counterargument: Is the Response an Overreaction?
While some might argue that halting all online operations is an overreaction, cybersecurity experts generally agree that it is a prudent measure in the face of a significant cyberattack. Suspending online services allows the company to thoroughly investigate the incident,mitigate the damage,and implement necesary security enhancements before resuming operations. A premature re-launch could expose the company and its customers to further risks.
M&S has reported the incident to the Information Commissioner’s Office (ICO) in the UK. A spokesperson from the ICO told the BBC M&S it was “assessing the information provided” after M&S told it about the incident. M&S also notified the National Cyber Security Center (NCSC) and the National crime Agency earlier in the week.
FAQ
Q: What should I do if I recently placed an order on the M&S website?
A: M&S has announced that it will refund all orders placed on Friday. If you placed your order before Friday, monitor your email and the M&S website for updates. Contact M&S customer service for specific inquiries.
Q: Can I still shop at M&S stores?
A: Yes, M&S has confirmed that its physical stores remain open and are operating as usual.
Q: Are other online retailers at risk of similar attacks?
A: All online retailers are potential targets for cyberattacks. Customers should use strong, unique passwords for each online account and monitor financial statements for any suspicious activity.
Q: What measures are M&S taking to resolve the issue?
A: M&S has engaged leading cybersecurity experts and is working to restore online operations. They are also communicating updates to customers via social media.
Q: How can businesses protect themselves from cyberattacks?
A: Implement strong cybersecurity measures such as firewalls,intrusion detection systems,and data encryption. Conduct regular security audits, train employees on cybersecurity best practices, and have a clear incident response plan.
Table of Contents
- 1. M&S reportedly suffered significant network downtime after they experienced a system outage. Can you address the potential methods attackers used as entry points with examples of both technical and perhaps social engineering vulnerabilities? Explain and elaborate with regards to retailers operating in this technological landscape”.
- 2. M&S Cyberattack: An Interview with Cybersecurity Expert,Dr. Evelyn Reed
- 3. Understanding the M&S Cyberattack: Interview Commencement
- 4. The Impact on Retail Operations
- 5. Security Vulnerabilities and Mitigation
- 6. Proactive Steps for Businesses
- 7. The Broader Threat Landscape
- 8. Preventative actions
- 9. Concluding Remarks
M&S Cyberattack: An Interview with Cybersecurity Expert,Dr. Evelyn Reed
Following the recent cyberattack that crippled Marks & Spencer’s online operations, Archyde News sought insights from leading cybersecurity experts. dr. Evelyn Reed,Principal Security Consultant at Protego Cyber Solutions,offers her expert analysis. We discuss the implications of the M&S incident and what it means for the future of retail cybersecurity.
Understanding the M&S Cyberattack: Interview Commencement
Archyde News: Dr. Reed, thank you for joining us today. M&S’s complete shutdown of online services is a significant step. What’s your immediate assessment of the situation?
Dr. Reed: Thank you for having me. The full impact won’t be known instantly. Shutting down the entire system points to a severe compromise, likely affecting critical systems and potentially customer data.
The Impact on Retail Operations
Archyde News: The article highlights that online sales represent a significant portion of revenue. How critical is this disruption?
Dr. Reed: Absolutely critical. The M&S incident shows a ample loss and damage to company reputation and also creates supply chain issues, even though physical stores stay operational. The longer the outage, the more of a toll it takes, and it will impact current profits and future customer trust.
Security Vulnerabilities and Mitigation
Archyde News: Besides the financial impact,customer trust seems heavily affected. What are the most likely vulnerabilities that were exploited?
dr. Reed: It’s arduous to say without a full forensics report, but common entry points include phishing attacks, exploited software vulnerabilities, including outdated, vulnerable software. Effective cybersecurity relies on a framework with several layers of protection.
Proactive Steps for Businesses
Archyde News: The article mentioned the importance of regular audits and employee training. What other proactive measures should businesses consider?
Dr. Reed: Incident response plans are critical. Develop clear steps when a breach occurs,including who needs to be notified,how communication is managed,and steps to take to contain the breach.This enables rapid recovery.
The Broader Threat Landscape
Archyde News: What is the future of retail cybersecurity, and which threats should the retailers prepare for?
Dr. Reed: The threats are evolving. Retailers need to focus on advanced threat detection and response. This includes employing AI-driven solutions to identify unusual behaviors. Cloud security is also very vital.
Preventative actions
Archyde News: Any thoughts to the consumers and what they can do?
Dr. Reed: For customers, stay vigilant.Use strong, unique passwords for online accounts. Monitor your financial statements for any unusual activity. Be wary of unsolicited emails or messages requesting personal information.
Concluding Remarks
Archyde News: Dr. Reed, thank you for sharing your insights. This incident highlights the growing sophistication of cyber threats.How can retailers learn from the M&S incident and improve their own security posture?
Dr. Reed: Learn from M&S’s situation, and start with reviews of current security protocols. Perform evaluations to identify vulnerabilities before attackers exploit them. Don’t wait. Retailers should invest in a robust and multi-layered security plan.
