M&S reveals cost of cyber attack as profit almost wiped out | Money News

The cyber attack on high street department store Marks and Spencer is expected to directly cost roughly £136m.

The figure is only the cost of immediate incident systems response and recovery, as well as specialist legal and professional services support.

Combined with a loss in sales, as the retailer’s online systems were out of action from Easter into the summer, statutory profit before tax at the business has been nearly wiped out for the first half of the year.

This profit measure dropped from £391.9m last year to £3.4m this year. Statutory profit before tax is the official profit figure reported in a company’s financial statements before it paid tax, used for tax and legal purposes.

About £100m is being claimed back in insurance for the cyberattack, M&S said in its market update.

Using a different profit measure – the M&S group’s adjusted profit before tax – the figure is more than half that of a year earlier, down from £413m to £184m.

Sales were hit as online shopping was unavailable from the April attack date until June. Some shelves were also empty in the days after the attack.

It wasn’t until August that the click and collect function was restored.

Ransomware hackers broke into M&S systems by tricking employees at a third-party contractor.

While overall sales volumes rose compared to the 12 months before fashion, mome and beauty sales dropped 16.4%
and international sales were down 11.6%.

The attack was just one of a series that struck major British businesses.

The Co-Op, Jaguar Land Rover and Harrods all had operations interrupted by cyber criminals.