Marks & Spencer (M&S) is navigating a period of significant upheaval following a debilitating cyberattack that has had profound financial and operational consequences for the British retailer. Rachel Higham, the company’s Chief Digital and Technology Officer, has departed just months after the attack, which forced the shutdown of M&S’s online operations and left physical stores struggling with empty shelves. According to an internal memo, Higham, who joined M&S in 2014 from roles at WPP and BT Group, is "stepping back from her role" after a turbulent period for the business. The company commended her as "a steady hand and calm head at an extraordinary time," though she is understood to be taking a career break. Sacha Berendji, a seasoned executive within M&S, has been appointed to head the digital and technology division alongside his current duties.

The cyberattack, attributed to a hacker group known as Scattered Spider, exploited human vulnerabilities rather than technical flaws in M&S’s defences. Investigations revealed that the attackers breached the retailer’s systems via social engineering tactics targeting a third-party contractor, bypassing M&S’s own digital safeguards. This sophisticated intrusion occurred over the Easter weekend in April and subsequently led to a near four-month suspension of parts of M&S’s digital operations, including the popular 'click and collect' service. The National Crime Agency is investigating the group reportedly responsible. Despite the severe impact, M&S has refrained from commenting on any ransom demands, citing law enforcement guidance.

Financially, the breach has been catastrophic. Industry estimates project a £300 million hit to M&S’s operating profit for the current financial year, coupled with a market capitalisation loss approaching £750 million. CEO Stuart Machin has emphasised that the setback, largely due to human error linked to the third-party contractor, has overshadowed an otherwise strong year for the company, which reported a 22% rise in adjusted pre-tax profits to £875.5 million and 6.1% sales growth to nearly £14 billion. M&S is employing various strategies to mitigate the losses, including cost management and insurance claims, with hopes of recovering around half the estimated impact.

Amidst this turmoil, leadership stability has been a topic of internal discussion. The company is reportedly considering extending the tenure of Chairman Archie Norman beyond the typical UK-recommended nine-year limit, given his pivotal role in steering M&S through a turnaround and now through this crisis. The final decision rests with the board and shareholders.

Adding complexity to the situation is the involvement of Tata Consultancy Services (TCS), M&S’s primary technology partner since 2018. TCS is conducting an internal probe to determine whether its systems served as the entry point for the attack. M&S CEO Machin has declined to specify whether ransom payments were made or to confirm TCS’s direct involvement, while both parties maintain silence on these details. This incident has also cast a shadow over TCS’s reputation, highlighting the growing cybersecurity risks faced by global IT service providers.

Despite the setbacks, M&S asserts its commitment to accelerating its technology transformation, compressing initially planned digital overhaul timelines from two years into six months, in an effort to fortify its systems against future threats. The company’s leadership changes and strategic focus underscore the critical importance of digital resilience in the retail sector as cyber threats become increasingly sophisticated.

📌 Reference Map:

Source: Noah Wire Services