M&S customers are in trouble as cyberattack chaos continues
Liv McMahon and Joe Tidy

Technical journalist and network correspondent

Reuters

Marks and Spencer (M&S) customers have been telling the BBC that the damage caused by cyber attacks is the damage caused by retailers, which continues until another trading week.

The incident (disclosed last Monday) has resulted in delays in packages, online orders and suspensions of gift card payments and has seen retailers cancel several parts of their operations in the past few days.

It has not disclosed the nature of the cyber attack or expected operations to return to normal. Some clients told the BBC that M&S’ communications were disappointing for affected orders.

Analysts warn that the incident could impact the reputation of retailers among its customers.

Dan Coatsworth, investment analyst at AJ Bell, said M&S’s success was “trust-based” – something customers might question after they pause their online orders.

"The longer you draw a line under a cyber incident, the greater the risk of marking and Spencer's reputation," he told the BBC.

“Shoppers want to know that their personal and financial details are safe when buying items online, and the tags and Spencer fail to give a completely clear hint, which means it’s wrong at the end.”

Customer impact

The customer described the problems of farming, self-checking and online orders in messages sent to BBC News.

Others said they had to cancel orders for clothes they expected to collect before their vacation, or could not return items they had previously purchased.

However, some people express sympathy for the store’s employees, saying they have been abused by angry customers or have to shop in tilling when they are unable to pay when they are unable to pay.

Gift cards and vouchers are still not working properly, according to many customers.

For some, these issues also affect gifts like flowers.

Linda Sonntag, who lives in Norwich, told the BBC that she was "disappointed" after arranging a delivery of flowers for a friend that never arrived.

While she has returned a separate clothing order, she said on Monday she is still waiting for a refund and email and provides information about her order.

“At the same time, I had to order flowers from other places,” she said.

Ms. Sonntag added: "I don't blame them, they conducted the cyber attack."

“But I don’t think their attitude towards the client is helpful.”

Dawn Cunnington of Exeter agreed that the company should not blame her, but said she had no communication about her spending orders not fulfilled.

She ordered flowers on Wednesday on behalf of her 91-year-old mother's friend who celebrated their 90th birthday.

"I had nothing until I called them," she told the BBC.

Ms Cannington said she received a refund and a £10 apology voucher after she called M&S to find out what happened to the flowers, but was “a bit of a cross” and given that she knew about the cyber incident, they allowed her to place an order first.

"Cat and Mouse"

M&S is silent on the development of cyber attacks, the nature of the attack, and the particular impact it has been subjected to - let cybersecurity experts speculate on what might have happened.

It is known that it has hired external cybersecurity experts, who are likely to be teams of incident response experts who will work 24/7 at the company headquarters or remotely.

Their first priority is probably to find out where the hacker is in the IT system and kick it out.

Turning off computer servers used in their online ordering, payment or logistics systems could mean that security teams isolate that section as a way for hackers to enter.

They may also take these offline to prevent hackers from spreading malware to previously unaffected areas.

The company may also take all non-enterprise critical services offline to help handle hackers.

"In this case, in-store services are often prioritized for recovery, which could mean that online operations require a slight recovery," said Sam Kirkman, director of cybersecurity firm NetSpi.

He told the BBC that while M&S takes steps such as suspending services may make the incident look "more severe from the outside", they will allow employees to tie any potential threats and start rehabilitation safely.

Stocks and sales

Meanwhile, the company's share price has fallen nearly 10% in the past week.

Retailers' shares fell 2.5% in morning trading on Monday as no update on customers or investors' decisions to suspend online orders on Friday.

About one-third of M&S's sales of clothing and household goods in the UK are through its online platform, worth approximately £1.268 billion in the latest published financial results.

Susannah Streeter, head of currency and markets at Hargreaves Lansdown, said that even though M&S' brick-and-mortar stores remain open, many of them "are not in stocking the popular range at all."

She added that sales “may be a big hit” because cyber attacks occur in warm weather when the range “stacks in virtual baskets” during summer season.

Other reports from Michael Contest