Marks & Spencer Says Cyberattack to Cost $403 Million

Article

Marks & Spencer Group Plc is facing a £300 million ($403 million) hit to operating profit this fiscal year from a cyberattack that’s still disrupting the company’s sales and operations.

The British retailer will try to mitigate the impact with cost savings and insurance payouts, it said Wednesday. Online clothing and home orders, which account for more than £3 million of sales a day and have been suspended for more than three weeks, will be disrupted into July.

It is a major setback for a business that was delivering on Chief Executive Officer Stuart Machin’s turnaround plan, recording the highest pretax profit in 15 years in the last fiscal year that ended before the attack. Shoppers have been buying more groceries and the brand has shaken off its reputation for dowdy clothes.

Marks & Spencer’s shares dropped as much as 4% in early trading in London. They were down 10% since the attack was announced on April 22 though Tuesday’s close.

Though M&S called it a “bump in the road,” the hit to operating profit — which is roughly equivalent to a third of last year’s performance — is worse than analysts expected. The attack forced M&S to halt contactless payments and created gaps on shelves as it took some IT systems offline. Last week it said some personal customer data was stolen.

Food sales have been impacted by reduced availability, although this is improving. The business also incurred additional waste and logistics costs as it switched to manual processes, hurting profit.

Marks & Spencer’s Sliding Shares Following Cyber Attack

A cybercrime gang known as “DragonForce” has taken credit for the M&S hack, as well as other attempts to infiltrate grocer Co-op Group and luxury department store Harrods Ltd. The group told Bloomberg it carried out the attacks with partners to extort money from victims and plans to hit the UK’s retail sector again, saying the recent breaches were “just a start.”

Cyber crime is an increasingly prevalent problem in the UK and worldwide. On Monday, hackers stole a “significant amount of personal data” from people who received legal aid across England and Wales, the UK’s Ministry of Justice said.

Last year a cohort of Russian-speaking hackers demanded a $50 million ransom from a UK lab-services provider to end a ransomware attack that paralyzed London hospitals for weeks.

Cyber attacks have cost UK businesses £44 billion in the last five years, according to a report by insurance group Howden in November. Half of UK businesses have suffered at least one cyberattack during that time, it said.

M&S reported £876 million in pretax profit for the financial year ending in March, beating analyst estimates. The company said it’s confident in prospects for medium-term growth, and is increasing its dividend by 20%.