Marks & Spencer: 'human error' and a £300m hit to profit

Marks & Spencer disclosed a cyber incident on 22 April 2025. Three days later it stopped taking online clothing orders. They did not fully return for 46 days.

The bill

• About £300m in lost operating profit, according to M&S.
• 46 days without online clothing orders.
• The CEO said the attack was the result of human error.

How it started

M&S has not published full technical detail. What its leadership did say is that a person was tricked. Widely reported accounts point to attackers persuading a help desk to give them access.

What to do this week

• Require a call-back check before any password or login reset.
• Make sure outside IT and help-desk providers follow the same rule.
• Practise refusing a confident, urgent caller.