Marks & Spencer Estimates Cyberattack Cost at €355 Million

The British retail group, deprived notably of online sales and contactless payments, does not expect a return to normal before July 2025.

On May 23, 2025, the British retail chain Marks & Spencer estimated the cost of the ongoing cyberattack at €355 million. The incident, ongoing since mid-April 2025, is likely due to ransomware. Its consequences have been severe for the group, which has had to suspend online sales and contactless payments.

The cyberattack has also caused significant supply chain issues, leading to emptied food shelves in many stores. Marks & Spencer does not anticipate a return to normal operations before July 2025. The company also confirmed a theft of personal data, which it says does not include sensitive information.

Investigators suspect the group Scattered Spider is behind the cyberattack, but have not yet confirmed this.