M&S CEO: Cyberattack Fallout Will Largely Be Over by August

Marks & Spencer CEO Stuart Machin told shareholders on Tuesday that the British retailer expects to be past the worst effects of a major cyberattack by August, as the company works to restore operations and rebuild consumer trust.

The April cyberattack dealt a serious blow to the company, causing a £300 million ($413 million) hit to profit. It forced M&S to shut down its online store for nearly seven weeks, disrupted stock automation systems, and led to empty shelves in stores during May.

Speaking at M&S’s annual shareholder meeting, Machin said: “I’m really hoping by August, the majority of this is behind us.” This marked the first opportunity for investors to question leadership directly about the incident and its aftermath.

Questions over preventability and accountability were front and center. When asked if the cyberattack could have been prevented, Chairman Archie Norman acknowledged that “there’s always something that could be done” and that M&S continues to examine the details of the breach. Machin added that the attack exploited a third-party contractor via a social engineering tactic.

The CEO defended M&S’s prior cyber readiness, noting that the company had quadrupled its investment in cybersecurity and tripled the size of its cybersecurity team in the year leading up to the breach. “I’m glad we invested then. I’m glad we continue to invest,” Machin said.

One shareholder raised concerns about executive accountability, questioning whether Machin’s £7.1 million pay package, which rose 39% last year, should be reduced in light of the incident. Norman responded that incentive pay was tied to shareholder outcomes and that it was too early to determine adjustments.

Currently, the M&S online store is still only partially operational, with full restoration expected within four weeks. Automation systems at the Donington logistics hub are also expected to be fully functional by August, according to Machin.

In the meantime, the company is focused on reinforcing internal training to defend against further attacks and to bolster awareness of social engineering vulnerabilities.