M&S Chairman Declines Confirming Ransom Payment After DragonForce Cyberattack

Marks & Spencer (M&S) suffered a significant ransomware attack earlier in 2025, attributed to the DragonForce ransomware group working with the Scattered Spider hacking collective, which led to the theft of extensive customer data and severe operational disruptions. Chairman Archie Norman confirmed the attack was traumatic and unprecedented in his experience, causing weeks of online ordering outages and empty store shelves, with an estimated financial impact of around £300 million. Despite multiple inquiries from UK Parliament committees, Norman refused to disclose whether M&S paid a ransom, citing ongoing law enforcement involvement, the sensitive nature of the case, and the desire to limit publicity for the attackers. The company opted not to communicate directly with the hackers, instead using professional intermediaries, and highlighted that the attackers often used media channels for demands. Norman emphasized that the decision to pay ransom involves evaluating what is actually received in return, noting the need to rebuild systems regardless of payment and the risk of data being published. Recovery efforts are ongoing and expected to continue through late 2025.