Case study · 2025
Marks & Spencer cyber attack, 2025
Impersonation through a third party led to ransomware, a 46-day pause in online orders and a £300m profit hit.
Social engineering · third party
What happened
- M&S chairman Archie Norman told a UK parliamentary committee that the attackers first got in on 17 April 2025 through a “sophisticated impersonation” that involved a third party, rather than by breaking through technical defences.
- The attack was followed by DragonForce ransomware. M&S paused online orders for clothing, home and beauty; online ordering resumed on 10 June 2025, after 46 days, and click and collect was restored in August.
- In its full-year results on 21 May 2025, M&S estimated the incident would reduce 2025/26 operating profit by about £300 million before mitigation and insurance.
Root cause
Attackers impersonated a legitimate user convincingly enough that a third party reset credentials for them. Identity checks in the support process, not a software vulnerability, were the weak point.
Control failures
- Help desk identity verification could be satisfied with information an attacker could gather.
- A third party with the power to reset credentials was part of the attack path.
- Recovering core online and logistics systems took weeks, showing limited resilience for the online business.
Lessons for GRC
- Treat password and MFA resets as high-risk transactions: call back on a known number, manager confirmation, or in-person checks for privileged users.
- Include outsourced help desks and IT service providers in access reviews and require them to follow your verification standard.
- Run tabletop exercises for social engineering scenarios, not only technical exploits.
- Model the cost of weeks without online sales in the business impact analysis and insurance review.