Marks & Spencer Reports $400M Loss From Cyberattack Impacting UK Operations

British retailer Marks & Spencer (M&S) suffered a sophisticated ransomware cyberattack that is expected to cost the company approximately £300 million (around $400 million) in operating profit across 2025 and 2026. The attack disrupted online operations, especially impacting the fashion, home, and beauty segments, as M&S was forced to halt online orders temporarily while restoring systems, with disruptions anticipated to continue into July. The cyberattack also caused losses in food sales due to reduced availability and increased logistics and stock management costs, while physical stores remained operational. The ransomware group DragonForce, operating through a ransomware-as-a-service model, claimed responsibility for the attack, which also targeted other UK retailers such as Co-op and Harrods. M&S confirmed that customer personal information, including names, addresses, and partial payment card data, was stolen after hackers exploited social engineering against employees at a third-party contractor, reportedly Tata Consulting Services. Despite this significant financial impact, M&S stated that it remains committed to its long-term growth strategy and is working to mitigate losses through cost management, insurance, and trading actions, while also facing a class action lawsuit from Scottish customers.