Marks & Spencer (M&S) confirmed on Wednesday that a recent cyberattack which disrupted its operations originated from a security breach at a third-party contractor, not from within its own IT systems. The attack, first disclosed on April 22, will continue to impact the British retailer’s operations for several more weeks, including a halt to online sales expected to last until July.
In a briefing with reporters, CEO Stuart Machin said hackers used social engineering tactics to infiltrate a contractor’s network, bypassing M&S’s internal digital defences.
“Unable to get into our systems by breaking through our digital defences, the attackers did try another route… entering through a third party rather than a system weakness,” Machin explained.
“Once access was gained, they used highly sophisticated techniques as part of the attack.”
Involvement of Tata Consultancy Services
M&S holds a long-standing IT contract with Tata Consultancy Services (TCS), and a source familiar with the investigation told Reuters that TCS may have been the access point exploited in the breach. TCS declined to comment, and Machin did not confirm whether TCS was the contractor in question.
Timeline and Response
Suspicious activity was first detected over the Easter weekend (April 19–20). According to Machin, the time from breach to detection was relatively short, particularly compared to the industry average of 10 days or more.
Immediately after discovering the breach, M&S involved cybersecurity experts, law enforcement, and government agencies.
So far, 600 systems have been scanned, and the process of gradually bringing them back online is underway.
Online Sales and Business Impact
M&S’s online retail operations remain suspended, and the company does not expect full functionality to resume before July. The company has not disclosed whether a ransom demand was issued, citing official advice.
The UK’s National Crime Agency is investigating the attack, reportedly focusing on a group of young, English-speaking hackers.
Despite having boosted its tech spending threefold over the past three years, Machin stressed that no organization is immune to cyber threats.
M&S generates nearly £14 billion ($19 billion) in annual sales, and the breach marks a major disruption for one of Britain’s most recognized retail brands.