Case Study: The Marks and Spencer Cyber Attack, United Kingdom (2025)

What Happened

In April 2025, Marks and Spencer (M&S), a FTSE 100 retailer with over 1,400 stores globally and approximately 65,000 employees, experienced a significant cyber attack that caused severe disruption to its operations for several weeks. The attack was attributed to a threat actor group known as Scattered Spider (also known as Octo Tempest), a sophisticated cybercriminal organisation responsible for a number of high-profile attacks against major organisations.

The attackers gained initial access to M&S systems through social engineering tactics targeting the company’s IT help desk, using a technique known as help desk social engineering in which attackers impersonate employees to trick support staff into resetting credentials or granting access without proper verification. Once inside M&S’s systems, the attackers deployed ransomware and exfiltrated data, including personal information relating to customers. The attack disrupted M&S’s online ordering systems, contactless payment capabilities and Click and Collect services, and the company took several systems offline as part of its response.

The Scale and Impact

• Online ordering was suspended for several weeks, causing an estimated revenue impact of over £300 million during the disruption period
• Customer personal data, including contact details and order history, was compromised, and M&S notified affected customers and the relevant regulatory authorities
• M&S’s share price declined approximately 12 per cent in the weeks following the attack, reflecting investor concern about both the immediate financial impact and the longer-term reputational and operational consequences
• The attack generated sustained media coverage and public scrutiny, with questions raised about the security practices of major UK retailers and the resilience of organisations of M&S’s scale
• The NCSC Annual Review 2025 cited the M&S attack alongside attacks on Co-op Group and Jaguar Land Rover as high-profile examples of the escalating threat environment facing UK organisations

Why This Case is Significant for Week 6

The M&S attack is chosen as this week’s case study not primarily because of its scale, but because it illustrates the convergence of the themes that have run throughout this course and the strategic issues that define the frontier of cyber security in 2025 and 2026.

• AI-enabled social engineering at its most dangerous: Scattered Spider is known for highly sophisticated social engineering, including AI-generated voice synthesis to convincingly impersonate employees when contacting help desks. The attack illustrates exactly the kind of AI-enhanced social engineering threat described in Step 1 of this week’s learning. Technical controls did not prevent initial access; human behaviour under social-engineering pressure was the decisive factor.
• Help desk as a critical attack surface: exploiting help desk social engineering as an initial access vector is a reminder that security controls are only as strong as the human processes that surround them. IBM’s 2026 cybersecurity trends report identifies help desk workflows as an increasingly targeted attack surface as perimeter defences improve. Any process that allows credential resets or access grants without rigorous identity verification is a potential entry point.
• Resilience in practice: M&S’s response, while imperfect, illustrated several principles of cyber resilience in action. The decision to take systems offline proactively, to communicate promptly with customers and regulators, and to engage specialist incident response expertise reflected the kind of pre-planned, exercised response capability that distinguishes organisations with genuine resilience programmes from those without. The weeks of disruption also illustrate why business continuity planning and the question of how the organisation continues to function while affected systems are offline matter so much.
• The reputational and financial stakes at scale: the £300 million revenue impact and a 12% share price decline represent the kind of business consequences that make cyber resilience a board-level financial priority. For managers, this scale of consequence at an organisation of M&S’s size underscores why proportionate investment in security management is not a cost to be minimised but a risk management necessity.
• The escalating regulatory environment: the M&S attack occurred against a backdrop of increasing UK regulatory attention to cyber resilience. The forthcoming Cyber Security and Resilience Bill, the NCSC’s Cyber Governance Code of Practice, and the growing expectations around board-level accountability all reflect a regulatory environment in which the consequences of inadequate security management extend beyond the business impact of the attack itself.

Reflection Activity

The M&S attack illustrates that even large, well-resourced organisations remain vulnerable to social engineering attacks that exploit human behaviour rather than technical weaknesses. Reflecting on the full arc of this course, from the CIA Triad in Week 1 to the strategic resilience themes of Week 6, consider: what is the single most important lesson you are taking from this course into your professional practice? How has your understanding of what it means to be a security-aware manager changed? Share your final reflections in the discussion forum as part of the course community’s collective learning review.