- Marks and Spencer restarts some online orders
- This follows a major cyberattack earlier in 2025
- Some systems have still not recovered
Marks & Spencer (M&S) has resumed online orders, over a month after the high street giant was hit by a major cyberattack.
46 days after the incident, standard home delivery for most of M&S’ clothing range is now available again across England, Scotland and Wales.
Click and collect orders are still suspended for now, with the company saying these will resume within “in the coming weeks”, with a company spokesperson telling Reuters, “It’s not the full range at the moment, we’ve focused on best sellers and newness…We’ll be bringing product online everyday so customers will see that grow over the coming days.”
M&S orders restart
M&S was apparently hit by the attack on April 22, revealing news of the incident several days later.
It is thought the attackers were able to break into its systems by compromising workers at Tata Consultancy Services, an Indian firm which provided third-party services to M&S.
The company has forecast the attack could cost it around £300 million in lost operating profit in its financial year.
It was recently revealed the hackers contacted M&S CEO Stuart Machin in a mocking email the day after the attack, demanding payment for the attack.
This email was sent from the DragonForce hacking collective, which carries out such attacks in return for payment or reward from other parties in exchange for a cut of any ransom payments.
M&S has not confirmed whether it has paid a ransom to the hackers, but did admit some customer data was stolen in the attack. This did not include any passwords or card or payment details, but home addressess, phone numbers and dates of birth may have been affected.
Anyone concerned their data may have been taken, we recommend using a dark web monitoring service, or using a breach monitor such as Have I Been Pwned to check for potential exposures.