Marks & Spencer Group Plc has warned that a cyberattack which disrupted its systems for more than three weeks will lead to a £300 million hit to its operating profit this fiscal year.
The British retailer, which had recently been delivering on a high-profile turnaround, said it is attempting to mitigate the impact through cost savings and insurance claims.
The retailer’s online clothing and home goods division, which generates more than £3 million in daily sales, has been unable to process orders since late April and is not expected to return to full operations until July.
The company also confirmed that some customer data was compromised, adding to the fallout from the breach.
Shares fell as much as 4% in early London trading before paring losses. The stock was down by more than 1% at 9:41 am.
It is down by 11% since the attack was disclosed on April 22.
M&S calls the incident a “bump in the road,” but analysts are surprised
While M&S said the incident is a “bump in the road,” the projected profit dent amounts to nearly a third of last year’s operating performance, coming as a surprise to analysts who had expected a less severe impact.
The effects of the cyberattack extend beyond the online store.
Contactless payments were temporarily disabled in physical outlets, and some food shelves experienced stockouts as IT systems were taken offline.
M&S reported increased waste and logistical challenges as it reverted to manual processing in the aftermath of the breach.
Although availability in food lines has begun to recover, analysts have already begun adjusting profit forecasts.
Some expect at least a 10% cut to their earnings estimates, though up to £100 million of the hit may be clawed back through insurance and internal measures.
Analysts say larger businesses are strong, investors could consider buying the dip
The incident has interrupted what had otherwise been a strong performance from the retailer.
For the financial year ending March, M&S posted £876 million in pretax profit — its highest in 15 years — and plans to raise its dividend by 20%.
Hargreaves Lansdown analyst Aarin Chiekrie wrote in a market comment that while the estimated 300 million GBP hit may have “frustrated” investors, the bigger picture needs to be kept in mind.
“The cyberattack is likely a one-off event, and the underlying business is performing well. M&S is gaining market share, improving profitability, and the balance sheet is in great shape,” he said.
The stock has fallen in recent weeks due to the incident and provides an attractive entry point for investors willing to ride out the near-term turbulence.
Hacker group threatens further attacks on UK retail
A group calling itself “DragonForce” has claimed responsibility for the attack, stating in messages to Bloomberg that it targeted M&S along with other UK retailers such as Co-op and Harrods in coordinated attempts to extort money.
The group has warned that more attacks on the UK retail sector are forthcoming.
The breach adds to growing concerns over cybersecurity vulnerabilities among British firms.
Cybercrime has cost UK businesses £44 billion over the last five years, according to a 2023 report from insurance firm Howden, with half of companies suffering at least one attack during that period.
The post M&S cyber attack: share price falls as retailer says hack to cost £300 mn; should you buy the dip? appeared first on Invezz