Yazılar

M&S Digital Chief Steps Down Months After Cyberattack

/in /tarafından

Marks & Spencer (M&S) announced on Thursday that Rachel Higham, its chief digital and technology officer, is leaving the company less than a year after a major cyberattack crippled its online operations.

Higham, who joined in June 2023, will be taking a career break, according to an M&S spokesperson. “She has been a steady hand and calm head at an extraordinary time for the business and we wish her well for the future,” the company said.

Fallout from the Cyberattack

  • In May, M&S estimated the hack would cost about £300 million ($405 million) in lost operating profit for the 2025/26 financial year.

  • The retailer said it hoped to offset about half of that hit through insurance payouts and cost controls.

Leadership Reshuffle

Higham’s departure has prompted a broader management shake-up:

  • Sacha Berendji, a long-time M&S executive, will now oversee digital and technology alongside his role in property and store development.

  • Thinus Keeve, retail director since June, will shift to report directly to CEO Stuart Machin.

Market Impact

M&S shares are down 8.5% year-to-date, as investors weigh the financial impact of the cyberattack alongside leadership changes.

UK Police Arrest Four Suspects Over Cyberattacks on M&S, Co-op, and Harrods

/in /tarafından

Four individuals under the age of 21 have been arrested in connection with cyberattacks that disrupted operations at major UK retailers Marks & Spencer (M&S), the Co-op, and Harrods, the National Crime Agency (NCA) announced on Thursday. The most severe incident occurred in April when a ransomware attack forced M&S to halt online clothing sales for nearly seven weeks, resulting in an estimated £300 million ($400 million) loss in operating profit.

The arrested suspects include three males aged 17, 19, and 19, and a 20-year-old woman. They were detained at their homes in the West Midlands and London. The NCA said they face allegations including offenses under the Computer Misuse Act, blackmail, money laundering, and involvement in organized crime. Authorities also seized their electronic devices, and the suspects are currently being questioned by the NCA’s National Cyber Crime Unit.

M&S Chairman Archie Norman revealed to lawmakers that the company had engaged with the U.S. FBI regarding the cyberattack. He suggested that loosely connected groups, possibly led by a hacking collective known as DragonForce, were behind the incidents. Norman also advocated for UK businesses to be legally mandated to report significant cyberattacks, noting that some major breaches recently went unreported.

M&S resumed online clothing orders on June 10 after a 46-day suspension, although click-and-collect services remain offline. CEO Stuart Machin expressed confidence that the company would be through the worst of the attack’s impact by August.

M&S CEO: Cyberattack Fallout Will Largely Be Over by August

/in /tarafından

Marks & Spencer CEO Stuart Machin told shareholders on Tuesday that the British retailer expects to be past the worst effects of a major cyberattack by August, as the company works to restore operations and rebuild consumer trust.

The April cyberattack dealt a serious blow to the company, causing a £300 million ($413 million) hit to profit. It forced M&S to shut down its online store for nearly seven weeks, disrupted stock automation systems, and led to empty shelves in stores during May.

Speaking at M&S’s annual shareholder meeting, Machin said: “I’m really hoping by August, the majority of this is behind us.” This marked the first opportunity for investors to question leadership directly about the incident and its aftermath.

Questions over preventability and accountability were front and center. When asked if the cyberattack could have been prevented, Chairman Archie Norman acknowledged that “there’s always something that could be done” and that M&S continues to examine the details of the breach. Machin added that the attack exploited a third-party contractor via a social engineering tactic.

The CEO defended M&S’s prior cyber readiness, noting that the company had quadrupled its investment in cybersecurity and tripled the size of its cybersecurity team in the year leading up to the breach. “I’m glad we invested then. I’m glad we continue to invest,” Machin said.

One shareholder raised concerns about executive accountability, questioning whether Machin’s £7.1 million pay package, which rose 39% last year, should be reduced in light of the incident. Norman responded that incentive pay was tied to shareholder outcomes and that it was too early to determine adjustments.

Currently, the M&S online store is still only partially operational, with full restoration expected within four weeks. Automation systems at the Donington logistics hub are also expected to be fully functional by August, according to Machin.

In the meantime, the company is focused on reinforcing internal training to defend against further attacks and to bolster awareness of social engineering vulnerabilities.