Quick answer: Over the Easter weekend of 2025, Marks & Spencer was hit by a cyberattack that forced it to pause online orders for weeks, left some store shelves empty and exposed customer data. M&S expected a hit of about £300 million to operating profit. Reports linked the attack to the Scattered Spider group and said the DragonForce ransomware was used.
| Key facts | |
|---|---|
| Date | April 2025 (Easter weekend), disruption into July 2025 |
| Organization | Marks & Spencer (UK retailer) |
| Type of attack | Ransomware with data theft |
| Attacker | Reported links to Scattered Spider; DragonForce ransomware reported |
| Impact | Online orders paused for weeks; customer data stolen; about £300 million expected operating profit impact |
| How they got in | Reported to involve social engineering via a third party |
Timeline
- Easter weekend, April 2025: M&S experiences problems with contactless payments and click and collect.
- Late April 2025: Online orders are paused.
- May 2025: M&S confirms customer data was stolen and estimates a £300 million hit to operating profit.
- June to July 2025: The company expects online disruption to continue as systems are restored.
What happened
Marks & Spencer is one of the UK’s best-known retailers. Over Easter 2025, customers noticed failing contactless payments and click and collect services. Within days, M&S paused online orders entirely, and some stores ran short of stock.
The company later confirmed that attackers had stolen customer data before encrypting servers. BleepingComputer reported that the DragonForce ransomware was used.
Who was behind it
Reports linked the attack to Scattered Spider, a loosely organized group known for convincing IT help desks to reset passwords and MFA for attackers posing as employees. Reports said attackers got into M&S systems through a contractor. The UK National Crime Agency said Scattered Spider was a key part of its investigation, while also pursuing other lines of inquiry. Other UK retailers, including Co-op and Harrods, reported attacks in the same period.
The cost
M&S estimated the attack would reduce operating profit by about £300 million before insurance and other mitigation. Reports also noted that more than £700 million was wiped off its market value in the weeks after the attack.
Lessons for your organization
- Help desks must verify identity strictly before resetting passwords or MFA, for example with a call-back to a known number or manager approval.
- Apply the same security standards to contractors and outsourced IT providers as to staff.
- Use phishing-resistant MFA for administrators.
- Plan how stores, payments and online orders keep working during an IT outage.
- Prepare clear customer communications about data theft and phishing risks.
This incident is part of our guide to major cyber attacks and data breaches, which compares the biggest incidents and the patterns behind them. Read about social engineering attacks and how to prevent them. To see whether the same weaknesses exist in your organization, take the free Cybersecurity Readiness Assessment.
Frequently asked questions
What happened in the M&S cyber attack?
A cyberattack over Easter 2025 forced M&S to pause online orders for weeks, disrupted stores and led to customer data being stolen.
Who hacked Marks & Spencer?
Reports linked the attack to the Scattered Spider group and said the DragonForce ransomware was used. The National Crime Agency investigated.
How much did the M&S cyber attack cost?
M&S estimated a hit of about £300 million to operating profit before insurance and other mitigation.
