M&S resumes online orders after 46-day outage

Marks & Spencer has begun accepting online orders again after suspending its website shopping for 46 days following a devastating cyber attack that struck over the Easter weekend.

The British high street retailer announced on Tuesday that customers can now purchase a selection of fashion products for home delivery to England, Scotland and Wales. The company said more fashion, beauty and homeware items would be added daily, with click and collect services and deliveries to Northern Ireland resuming “in the coming weeks”.

John Lyttle, managing director of fashion, home and beauty at Marks & Spencer, said in a social media post: “We are bringing back online shopping this week. A selection of our best-selling fashion ranges will be available for home delivery to England, Scotland and Wales from today.”

The 141-year-old retailer first disclosed it was managing a “cyber incident” on 22nd April, initially affecting click and collect and contactless payment services. The company suspended all online orders on 25th April and warned that disruptions could continue until July.

The cyber attack has proved enormously costly for Marks & Spencer, with the company estimating it will reduce this year’s profits by approximately £300 million – equivalent to a third of its annual profit. The retailer expects only about half of this impact to be offset through insurance payouts and cost control measures.

During the attack, hackers gained access to personal customer data, potentially including telephone numbers, home addresses and dates of birth. However, the company has assured customers that payment details, card information and account passwords were not compromised.

The BBC reported that the hacker group DragonForce sent an abusive email directly to chief executive officer Stuart Machin on 23rd April, gloating about the attack and demanding payment. The message, written in broken English, was sent using a hijacked employee email account. Machin has refused to disclose whether the company paid any ransom to the hackers.

Speaking to the Mail on Sunday, Machin described his initial reaction to the attack: “I went into shock. It’s in the pit of your stomach, the anxiety. But you have to think: ‘Stuart, you have to lead this, you have to keep a cool head’.”

The chief executive officer said the company would accelerate its digital infrastructure overhaul, reducing the planned timeline from three years to “a year and a half”. He added: “I have learnt everyone is vulnerable. The hackers only need to be lucky once.”

Marks & Spencer shares rose more than 3 per cent in early trading following the announcement, making it among the top performers on the FTSE 100. The retailer had been losing an estimated £25 million per week in online clothing and homeware sales during the suspension.

The attack on Marks & Spencer was part of a broader wave of cyber incidents affecting major British retailers, with the Co-op, Harrods, Adidas and Victoria’s Secret also reporting attacks in recent months.