Marks & Spencer (M&S) faced a severe cyber attack in April, which its chair, Archie Norman, described as an attempt to "destroy" the business. The attack, attributed to the hacker group DragonForce, forced the retailer to suspend online operations and left customers facing empty shelves. The incident is projected to cost M&S around £300 million in profits, although the company hopes to recover some losses through insurance.

Impact and Response

The cyber attack, which began on April 17 and was detected two days later, involved sophisticated ransomware tactics. M&S's key online distribution center in Castle Donington remains offline, and the company is still in "rebuild mode." Norman told MPs that the attack felt like an "out of body experience" and left the cyber team working tirelessly with minimal rest.

Call for Cybersecurity Regulations

In his testimony to the Business Select Committee, Norman advocated for mandatory reporting of significant cyber attacks to the National Cyber Security Centre (NCSC). He revealed that two major cyber incidents involving large UK companies had gone unreported in recent months. Norman emphasized the importance of transparency in helping other businesses protect themselves from similar threats.

Cybersecurity Investments and Challenges

Despite investing hundreds of millions in cybersecurity and expanding its prevention team to 80 staff, M&S fell victim to the attack due to vulnerabilities exploited through impersonation and third-party contractors. Norman dismissed media claims that M&S had left its systems vulnerable, stating, "The attacker only has to be lucky once."

Collaboration with Authorities

M&S has been working closely with UK and US authorities, including the FBI and the Metropolitan Police, to address the breach. While Norman declined to comment on whether a ransom was paid, he noted that any business considering such a payment must weigh the potential outcomes, as "substantially the damage had been done."