Skip to main content

M&S faces £300m profit hit as cyber attack leaves food to do heavy lifting

Date: 21 May 2025

2 minute read

21 May 2025

If you are covering the latest financial results from M&S, and the impact of the cyberattack on the company, please find below a comment from Lucy Rumbold, equity research analyst at Quilter Cheviot:

“Marks & Spencer’s latest results are a good set of numbers, but they were always going to overshadowed by the ongoing cyber attack. M&S has taken extreme measures to help contain the attack and protect customer data, including suspending online orders. It was confirmed disruption to that part of the business will continue throughout June and into July, before the company can start operating at full tilt once again. 

“Ultimately, this is going to have a huge impact on its profits, with management guiding to a hit of around £300m, although it expects insurance and cost control will cover some of that figure. Given the shares are down 13% since the cyber attack started this has already been largely priced in by the market, and will be further offset by the strong performance of the business up to this point.

“Food, one of the strong performers for M&S of late, has been disrupted with a lack of availability as well as increased waste and logistics costs due to manual processes being required. However, food sales are already seen to be improving, and M&S will hope this division can do a lot of the heavy lifting while other areas look to get back onto their feet.

“M&S has had strong momentum over the last year or so, but this cyber attack highlights just how damaging things like this can be. We now have a clearer picture around the profit damage, however uncertainty on the duration of the attack remains, leaving the company vulnerable to further risks in the market. Furthermore, M&S is increasing its capital expenditure, with around a third being invested in technology infrastructure so it can avoid such scenarios in the future. It will clearly be a long slog to get it back to where it was, but given the strong performance of late and provided the attack can be wholly eliminated, the business should get there.”

Gregor Davidson

Senior External Communications Manager