Cyber resilience: A wake-up call from the M&S incident

For retail, cyber resilience is now a frontline business imperative.

This year's cyber attack on Marks & Spencer (M&S) is a stark reminder of how fragile digital ecosystems can be, and how quickly customers' trust can evaporate when security fails.

The M&S breach: A case study in vulnerable supply chains

Hackers didn't breach M&S directly. Instead, the entry point was a third-party supplier whose systems were compromised through sophisticated phishing and social engineering tactics.

The attackers – identified as the cyber-crime group Scattered Spider – manipulated the supplier's IT staff into resetting credentials, which effectively handed over access to M&S's digital infrastructure.

The fallout was severe:

• £300 million in expected operating profit losses

• Over £750 million wiped from M&S's market value

• Online services suspended, including contactless payments and Click & Collect

• Customer data compromised, leading to an unprecedented class-action lawsuit

This incident underscores a hard truth: your cyber resilience depends on critical suppliers who must protect themselves – or risk your security.

Customer fallout and legal repercussions

Beyond financial losses, M&S faced a crisis in terms of harm to its reputation. Over 350 customers joined a class-action lawsuit, citing distress, an increased risk of scams and time spent securing their accounts.

While M&S acted swiftly to contain the breach and communicate transparently, the damage to customers' trust was already done.

How Next gained a competitive advantage born of disruption

While M&S struggled to recover, rival retailer Next saw a surge in sales. In the second quarter of 2025, Next's full-price sales jumped 10.5%, significantly outperforming expectations.

The company attributed part of this growth to "trading disruption at a major competitor" – a clear reference to M&S.

Next upgraded its annual profit forecast to £1.1 billion, marking its third upward revision in five months. This highlights how cyber security lapses can not only harm the affected business but also shift market dynamics in favour of competitors.

This last bit is important for decision-makers to understand. M&S lost customers because of its cyber resilience posture. I hear far too often that cyber resilience doesn't equate to a competitive advantage – it absolutely does and, in this case, Next was the main beneficiary.

Why cyber security must be a retail priority

The M&S incident is not isolated. Retailers like Co-op and Harrods have also faced breaches in 2025. Here's why all retail businesses, no matter what their size, must build cyber resilience into every strategy:

1. Retailers are prime targets: 24% of all cyber attacks target retail due to the volume of sensitive customer data the companies tend to hold.

2. AI-powered threats are rising: Attackers now use deepfakes, botnets and machine learning to bypass traditional defences.

3. Internet of Things (IoT) vulnerabilities: Smart shelves and kiosks introduce new ways to attack.

4. Regulatory pressure: GDPR and PCI DSS 4.0 demand companies comply strictly with the rules, or risk being landed with hefty fines.

5. Customer trust is fragile: A single breach can deter over 60% of shoppers from returning.

Conclusion

As a retailer, you must rethink cyber resilience as a shared responsibility across your supply chains. This means:

• enforcing multi-factor authentication (MFA)

• conducting regular phishing simulations

• putting network segmentation in place

• vetting and monitoring third-party vendors

• investing in incident response and recovery plans that include exercises and simulations

A lot of this can be technical, so contact the P3M Works team to learn how we can help you with your cyber resilience. We have a depth of experience across many different industries.

The M&S breach is a cautionary tale, but we can also see it as a catalyst for businesses to change and become resilient. In a digital-first retail world, cyber resilience is no longer about protection only. It's now a case of survival.

People also read

• Cyber security for small businesses: A basic guide

• How being cyber-savvy can support you with your business

• What is a data breach and how do you guard against one?