Marks & Spencer’s website is back online after being inaccessible to users for several hours on Wednesday evening, capping weeks of disruption caused by a major cyber-attack over the Easter weekend.
Customers visiting the site on Wednesday were greeted with a message stating, “Sorry you can’t browse the site currently. We’re making some updates and will be back soon.” By Thursday morning, the retailer confirmed that browsing functionality had been restored following overnight updates, although full services remain limited.
The attack, which initially affected click-and-collect services and contactless payments, forced M&S to suspend all online orders in the days following the breach. While the website is now viewable, the company has warned that online shopping will remain partially disrupted until July, with services returning in phases.
On Wednesday, M&S disclosed that the cyber-attack could result in a profit hit of up to £300 million this financial year—a figure significantly higher than analysts had anticipated. While insurance is expected to cover part of the loss, the full financial and operational impact is still unfolding.
In a statement, M&S chief executive Stuart Machin described the incident as “a highly sophisticated and targeted cyber-attack,” acknowledging the severity of the breach and the ongoing challenges to restore normal operations.
The company has also confirmed that some customer data was compromised in the breach. The stolen data may include telephone numbers, home addresses, and dates of birth, but M&S stressed that no usable payment information, card details, or account passwords were accessed. However, online order histories may have been affected.
Law enforcement agencies are currently focusing on a cybercriminal group known as Scattered Spider, an English-speaking hacking collective believed to be behind the attack. The BBC has reported that the same group is linked to previous breaches at Co-op and Harrods, though the attack on M&S is thought to have caused the most significant disruption.
Despite the setback, M&S said it is working urgently to restore full online services. In a statement on Thursday, the company said: “Our website is open for browsing. As we work to get things back to normal for our customers, we are doing some overnight updates.”
Customers are advised to remain cautious and monitor their accounts for any unusual activity as the investigation and recovery efforts continue.
