Cyber Risk Management and Business Continuity: A Case Study of Marks & Spencer
Get Free Assignment Quote Instantly
This case study examines the 2025 cyberattack on Marks & Spencer, exploring its financial impact, operational disruption and recovery strategy. It applies risk management, business continuity and crisis communication theories to assess how the retailer protected its competitive advantage and provides practical lessons for organisations, supported by relevant assignment help, on managing cybersecurity threats and business resilience.
Introduction to Cyber Risk Management: A Case Study of Marks & Spencer
Marks & Spencer (M&S) is a UK retailer that sells food, clothing and home products. It has about 64,000 staff and 565 stores (Reuters, 2025). In April 2025, M&S was hit by a major cyber attack over the Easter weekend. The attack first hit contactless payments and click and collect. Later, the company had to stop all online clothing and home orders (Retail Sector, 2025).
This case study looks at the M&S attack through three simple questions:
- What happened, and how badly did it hurt the business?
- How did M&S manage the crisis?
- What can other companies learn about protecting their competitive advantage?
The case is useful for students because it is recent, it involves a UK company, and the financial numbers are public. It also shows that a technology failure is not only an IT problem. It is a business problem that affects sales, profit, share value and customer trust.
Concepts, Theories and Frameworks
Before looking at the case, it helps to understand the ideas used to study it.
Risk management process
Risk management is the process of finding risks, judging how serious they are, and deciding what to do about them. A simple version has four steps:
- Identify: find what could go wrong (for example, a ransomware attack).
- Assess: judge how likely it is and how much damage it could cause.
- Respond: reduce the risk, move it (for example, through insurance), accept it or avoid it.
- Monitor: keep checking, because new threats appear all the time.
Many companies use this process for cyber risk. The weak point is often step two. Leaders may think a big attack is unlikely, so they do not spend enough on protection.
Business continuity
Business continuity means keeping key services running, or restoring them quickly, when something goes wrong. A strong plan includes backup systems, clear roles for staff, and manual ways to keep trading if technology fails. In M&S's case, the key test was how long the company could keep selling when its online systems were down.
Crisis communication
Coombs (2007) argues in Situational Crisis Communication Theory that the way a company responds to a crisis should match how much blame the public gives it. If people believe the company could have prevented the problem, the company needs to take more responsibility and show clear action. This helps protect the company's reputation.
Competitive advantage
Porter (1985) describes competitive advantage as what lets a company perform better than its rivals, for example through lower costs or a stronger offer for customers. For a modern retailer, online sales, supply chain systems and customer data are all part of that advantage. If they stop working, the advantage can disappear quickly.
What Happened at Marks & Spencer
The main events are shown below.
- Easter 2025: M&S was hit by a cyber attack. Click and collect and contactless payments were affected first (Retail Sector, 2025).
- Late April 2025: M&S paused online orders. The attack also affected stock levels in stores and card payment systems (LBC, 2025).
- May 2025: Analysts said M&S was the victim of a ransomware attack. The company did not pay the criminals, following government advice, and worked to rebuild its computer systems (Reuters, 2025).
- May 2025: M&S said the attack could cost around £300 million in operating profit before insurance and cost savings (Retail Sector, 2025).
- June 2025: Home delivery orders started again.
- August 2025: Click and collect was restored (The Record, 2025).
The chief executive said the attack was caused by human error (TheIndustry.fashion, 2025). Other reports also linked the incident to a leak of customer data (Liga.net, 2025). Students should be careful here. Public statements from companies do not always give the full technical picture, so a good assignment should say which claims come from the company and which come from outside analysts.
Impact on the Business
The financial impact was large and the numbers are public.
- Online dependence: Online sales usually make up about one third of M&S clothing and home sales (Reuters, 2025). This is why stopping online orders hurt so much.
- Share value: More than £1.3 billion was wiped off the company's market value in the days after the attack (LBC, 2025).
- First half results: Underlying profit for the first half of 2025/26 fell by 55.4% to £184.1 million (Apparel Resources, 2025). Reported profit fell from £391.1 million to £3.4 million (The Record, 2025).
- Fashion, home and beauty: Sales in this division fell by 16.4%. Online sales fell by 42.9%, and store sales fell by 3.4% (Apparel Resources, 2025).
- Full year: Adjusted profit before tax for the year to March 2026 was £671.4 million, down from £881.1 million the year before. The costs linked to the hack were £131.3 million (ESM Magazine, 2026).
Two points stand out. First, the final cost was lower than the first £300 million warning. This was partly because of insurance and cost savings (TheIndustry.fashion, 2025). Second, the food business did well and helped to reduce the damage. This shows the value of having more than one source of income.
Note for students: different news sites report slightly different profit figures. This is because some use underlying profit and some use reported profit. Always check which measure is being used and quote it clearly.
Response and Recovery
Safety before speed
M&S did not rush to restart online shopping. Reuters reported that the company put safety ahead of speed while it reinstalled its systems (Reuters, 2025). This was costly in the short term. The online shop was closed for more than six weeks, and full recovery of online sales took until August. However, restarting too early on weak systems could have led to a second attack and a bigger loss of trust.
Not paying the ransom
M&S refused to pay, following government advice (Reuters, 2025). Paying does not guarantee that data or systems come back, and it can encourage more attacks. This was a risk response of "refuse and rebuild". It protected the company's long-term position but made the short-term recovery harder.
Communication
Using Coombs' (2007) theory, the public was likely to put some blame on M&S, because the company holds customer data and was expected to protect it. The CEO's admission of human error and his comment that recovery was slower than the company would have liked (Liga.net, 2025) show an attempt to take responsibility. Students can discuss whether this was enough, or whether earlier and more detailed updates would have protected trust better.
Insurance
Analysts said cyber insurance would probably cover most of the impact, but that this cover is usually limited in time (Reuters, 2025). This is an important point for risk management. Insurance moves part of the cost but does not remove the damage to customers and reputation.
Competitive Advantage After the Attack
The attack tested M&S's competitive advantage in three ways.
- Online channel: For several weeks, rivals with working websites could take sales that M&S could not. M&S also missed sales of its new season ranges (Reuters, 2025). In Porter's (1985) terms, a strength became a weakness.
- Store network: Store sales fell by only 3.4% (Apparel Resources, 2025). This suggests that physical stores kept customers loyal and acted as a backup when online systems failed.
- Food business: Strong food sales reduced the group-level damage. This shows that a mixed business can protect a company from a single failure.
The lasting risk is that some customers may have moved to other brands during the outage. The chairman said in July 2025 that the business would still be rebuilding for some months (The Grocer, 2026). Full recovery depends on winning those customers back.
Lessons and Recommendations
From this case, other companies can take these lessons:
- Plan for failure, not only for success. Test the business continuity plan often, including manual ways to take orders and payments.
- Protect people as well as systems. If human error was a cause, regular staff training and strong access checks matter as much as software.
- Check the whole supply chain. Third parties with access to company systems are part of the risk.
- Do not depend on one channel. A strong mix of online, stores and food limited the damage at M&S.
- Talk early and honestly. Clear updates to customers, staff and investors reduce uncertainty.
There is also a limit to this case study. Full details of how the attackers got in have not been shared in public. Any conclusion about the exact cause should therefore be treated with care.
Conclusion
The 2025 attack on Marks & Spencer shows how fast a cyber incident can become a business crisis. Online sales stopped for weeks, profit fell sharply, and billions were lost from the share value in a short time. At the same time, the company's choice not to pay, its safety-first recovery, its strong food business and its store network helped it to survive and recover. For students, the case shows that cyber security is not only a technology topic. It is part of risk management, strategy and brand reputation, and it can decide whether a company keeps its competitive advantage.
References
- Apparel Resources (2025) Cyber attack cuts M&S H1 profit 55.4% amid online disruption. Available at: https://apparelresources.com/business-news/retail/cyber-attack-cuts-ms-h1-profit-55-4-amid-online-disruption/ (Accessed: 30 October 2026).
- Coombs, W.T. (2007) 'Protecting organization reputations during a crisis: the development and application of Situational Crisis Communication Theory', Corporate Reputation Review, 10(3), pp. 163-176.
- ESM Magazine (2026) M&S expects profit recovery after cyber hack-driven slump. Available at: https://www.esmmagazine.com/retail/ms-expects-profit-recovery-after-cyber-hack-driven-slump-312342 (Accessed: 30 October 2026).
- LBC (2025) M&S resumes online orders following £300m cyber attack. Available at: https://www.lbc.co.uk/article/m-and-s-resumes-online-orders-following-300m-cyber-attack-rpX7b_2/ (Accessed: 30 October 2026).
- Liga.net (2025) Marks & Spencer's profits plummet due to cyberattack that halted the retailer's online business. Available at: https://biz.liga.net/en/fmcg/news/marks--spencers-profits-plummet-due-to-cyberattack-that-halted-the-retailers-online-business (Accessed: 30 October 2026).
- Porter, M.E. (1985) Competitive Advantage: Creating and Sustaining Superior Performance. New York: Free Press.
- Retail Sector (2025) M&S restarts online orders after cyber attack. Available at: https://www.retailsector.co.uk/671256-ms-restarts-online-orders-after-cyber-attack/ (Accessed: 30 October 2026).
- Reuters (2025) 'M&S' slow recovery from cyberattack puts it at risk of lasting damage', 19 May. Available at: https://www.thestar.com.my/tech/tech-news/2025/05/19/ms039-slow-recovery-from-cyberattack-puts-it-at-risk-of-lasting-damage (Accessed: 30 October 2026).
- The Grocer (2026) M&S food flying but fashion still hungover from cyberattack. Available at: https://www.thegrocer.co.uk/news/mands-food-flying-but-fashion-still-hungover-from-cyberattack/723950.article (Accessed: 30 October 2026).
- The Record (2025) Cyberattack ate up profits for first half of year, retailer M&S says. Available at: https://therecord.media/marks-spencer-profits-wiped-out-cyberattack (Accessed: 30 October 2026).
- TheIndustry.fashion (2025) Marks & Spencer profits plunge after costly cyber attack, 5 November. Available at: https://www.theindustry.fashion/marks-spencer-profits-plunge-after-costly-cyber-attack/ (Accessed: 30 October 2026).
Unlock Full Sample
Enter your details to view the complete sample for free.
Academic Integrity Policy
This model solution is provided free of charge to serve as a structure reference guide for research, planning, or referencing formatting study. It should not be submitted directly as your own final coursework.