What UK businesses can learn from the M&S attack

When Marks & Spencer was hit by a major cyber incident in April 2025, the impact went far beyond a few systems being temporarily unavailable.

Online orders were paused. Click & Collect was disrupted. Some internal processes were taken offline. Warehouse management systems were disconnected and teams had to introduce manual processes to keep parts of the business moving.

Customer data was also taken.

For one of Britain’s biggest retailers, what started as a cyber security incident quickly became a major operational and financial problem.

And that is perhaps the biggest lesson for other UK organisations.

Cyber security isn’t just about protecting your IT. It’s about protecting your ability to do business.

What happened to M&S?

M&S first publicly confirmed it was managing a cyber incident in April 2025.

As part of its response, the retailer took some systems and processes offline to protect customers, colleagues, suppliers and the wider business. Click & Collect was affected and, a few days later, M&S paused online orders through its websites and apps.

The disruption extended behind the scenes too. M&S later confirmed that the response required warehouse management systems to be disconnected, with manual processes introduced to help maintain forecasting, ordering and replenishment.

Some personal customer data was also taken. M&S said this could include names, email addresses, postal addresses, telephone numbers, dates of birth, online order histories and some household information. It said usable payment or card details and account passwords were not included.

The financial impact was significant.

M&S initially estimated the incident could have an impact of around £300 million on operating profit before mitigation.

Its subsequent 2025/26 results reported £131.3 million in incident-related costs, alongside £100 million in insurance proceeds.

Those numbers are huge, but the lesson isn’t limited to businesses the size of M&S.

What happens when your technology stops?

Most organisations now rely on technology to operate.

It might be a customer portal, CRM, booking system, ecommerce platform, mobile app or bespoke piece of software. Behind those systems could be APIs, integrations, databases and third-party services connecting different parts of the organisation.

We tend to notice these systems when they’re working.

It’s when they’re suddenly unavailable that their importance becomes obvious.

Think about your own organisation for a moment.

What would happen if your customers couldn’t place an order tomorrow? Could your team work without your CRM? What if your booking system became unavailable? Could you fulfil orders if your warehouse software went offline? How long could you operate using manual processes?

For M&S, the scale was enormous. For a smaller organisation, the numbers would obviously be very different.

But the dependency can be just as important.

A business doesn’t have to lose £100 million for a cyber incident to be serious. A few days of lost orders, disrupted operations, recovery costs and unhappy customers could have a substantial impact on an SME.

A cyber attack isn’t only about stolen data

When we talk about cyber attacks, the conversation often focuses on data breaches.

That’s understandable. Organisations hold customer details, employee information, commercial data and other confidential information that needs protecting.

But the M&S incident demonstrates another side of cyber risk… disruption

The National Cyber Security Centre warns that a highly disruptive cyber attack can prevent an organisation from operating normally, with consequences potentially affecting customers, services, supply chains, finances and reputation.

Recovery can take weeks or even months.

That changes the question organisations should be asking.

Rather than only asking “What data could somebody steal?”

Businesses should also consider “What happens if one of the systems we depend on suddenly stops working?”

Both questions matter.

Working software isn’t necessarily secure software

There’s another important point for organisations that develop or operate their own software.

A system can work perfectly and still contain vulnerabilities.

Your customers may be able to log in. Orders might process correctly. Your API might communicate with another platform exactly as expected.

None of that necessarily tells you whether the software is secure.

Potential weaknesses can exist within application code, authentication, APIs, configurations and third-party dependencies. Credentials or API keys can accidentally become exposed. A package used within an application can develop a known vulnerability long after it was originally installed.

And software doesn’t stand still.

Developers release updates. New functionality is added. Integrations change. Dependencies are updated. AI is increasingly being used to generate code and create new applications at speed.

Every change can potentially alter the security profile of the software.

That’s why security shouldn’t be something organisations check once and then forget.

So what can UK organisations do?

There is no single tool that can guarantee a business will never experience a cyber attack.

Good cyber security is built in layers.

A useful starting point is simply understanding what you have. Know which applications and systems your organisation relies upon, what information they can access, how they connect to each other and who is responsible for maintaining them.

Keep software and dependencies updated. Protect credentials. Control access appropriately. Make sure backups and recovery processes exist and, importantly, test whether they actually work.

Think about what you would do if a critical system became unavailable.

The NCSC’s latest guidance encourages organisations to prepare for both the immediate response to a disruptive cyber attack and the potentially much longer process of recovery and rebuilding.

But organisations should also be looking proactively for weaknesses before an incident happens.

Regular vulnerability management can help identify potential security issues, understand their severity and prioritise what needs fixing.

Formal penetration testing has an important role too, particularly where organisations need deeper human-led testing or independent assurance.

These aren’t necessarily alternatives.

Security is stronger when organisations use different layers of protection rather than relying on one annual test or assuming their existing controls will catch everything.

Find vulnerabilities before someone else does

The M&S incident doesn’t tell us that every business is about to suffer a major cyber attack.

Nor would it be responsible to suggest that one particular security product could have prevented what happened to M&S.

What it does demonstrate is the potential consequence when technology that a business relies upon becomes compromised or unavailable.

That should prompt organisations to look at their own exposure.

• What software are we running?
• What information can it access?
• What does it connect to?
• When was it last security tested?
• If there are vulnerabilities within it today, would we know?

These are some of the questions that led us to develop Hacka.

Hacka helps organisations and development teams analyse their applications and codebases for potential vulnerabilities, exposed credentials, dependency and supply-chain risks and other security weaknesses.

Rather than simply producing a long list of technical findings, Hacka helps prioritise them and provides remediation guidance so teams can understand what matters and what they should address first.

It’s one layer within a wider cyber security strategy.

Because the objective isn’t to pretend that cyber risk can be completely eliminated.

It’s to understand where you’re exposed, reduce unnecessary risk and make it harder for an attacker to succeed.

The M&S incident is an extreme example of what can happen when a cyber security problem becomes a business problem.

For other UK organisations, the lesson is much simpler… don’t wait for an incident to start asking where you’re vulnerable.