M&S cyberattacks are about to eliminate nearly one-third of their annual profit

Mark & ​​Spencer Group Plc (M&S) store in Thames, Kingston, UK.

Bloomberg | Getty Images

UK retailers Marks & Spencer Recent cyberattacks exposed food shelves and put online sales to a standstill will eliminate nearly a third of their annual profit, it said Wednesday.

The company, known for its clothing, household goods and food, said last month's cyberattack would cost the company £300 million ($403 million) of operating profit this year.

"Our current pre-empt estimates have an impact on group operating profit of approximately £300 million in 2025/26," the company said in a statement.

It added that through administrative costs, insurance and other transaction measures, the financial impact will be reduced, and its costs are related to the event and will be presented separately as adjustment items.

As of March 29, 2025, the forecasted impact amount was equivalent to 30.5% of the company's annual operating profit of £984.5 million, and as of March 29, 2025, the project would have increased by 17% year-on-year.

The cyber attacks during the Easter holiday have wiped over £1 billion from M&S's stock market value and continue to cause online retail disruptions, which the company says can last until July.

The High Street giant said that “highly complex and targeted cyber attacks” have led to “limited periods of destruction,” but the incident also marks an opportunity for a technology transformation plan announced last year.

Stock chart iconStock chart icon
Hide content

Multiple sclerosis.

"We will use this disruption window to accelerate our technology transformation plan; the plan we made a year ago. In fact, we will put the two-year plan in just six months," CEO Stuart Macchin said in his earnings introduction on Wednesday.

The incident caused a shock wave across the industry, with co-ops and retailers such as Harold facing recent attacks.

Minglin said he would not pay any ransom for retailers in cyber attacks, according to Reuters. He also noted that the incident was the result of “human error” without providing more details.

“We will now draw a line on this and continue to do business as usual,” he said.

Lucy Rumbold, an Equity Research analyst at Quilter Cheviot, said cyber attacks “covered” for retailers, otherwise the annual results would be reliable, but added that many of the impacts have been priced.

By 10:23 am London time, M&S shares rose 0.68%.

"This kind of cyber attack highlights such destructiveness," Lumbed said via email. "We now have a clearer understanding of the loss of profits, regardless of the duration of the attack remains uncertain, leaving the company vulnerable to further market risks."

Businesses are increasingly labeling cyber threats as critical risks to their operations. JD Sports On Wednesday, “a major cyber attack” cited the store’s sales, a “serious but reasonable” downward situation.