M&S boss urges shoppers to visit stores in person as it battles cyber-attack

The boss of Marks & Spencer has urged customers to come into its stores to shop in person this bank holiday weekend as the retailer works “day and night” to tackle the cyber-attack that has crippled its online operation.

The retailer’s IT systems were hit by a major ransomware attack almost two weeks ago. It is still not taking online orders, and the availability of some products in its stores has been affected after it took some of its systems offline in response.

“We are really sorry that we’ve not been able to offer you the service you expect from M&S over the last week,’ said the chief executive, Stuart Machin, in a post to customers on LinkedIn. “We are working day and night to manage the current cyber incident and get things back to normal for you as quickly as possible.

“Our teams are doing the very best they can, and are ready to welcome you into our stores – whether you are shopping for food or for fashion, home and beauty this bank holiday weekend.”

M&S first reported problems over the Easter weekend, when it stopped taking click-and-collect orders and its contactless payments were affected. Contactless payments have since restarted.

The Metropolitan police have confirmed they are investigating a cyber-attack, with a hacking collective known as Scattered Spider linked to the hack.

A spate of cyber incidents have hit retailers over the past week, including the Co-op, which shut off parts of its IT systems after an attempted hack, and the luxury department store Harrods, which said on Thursday that it had also had to power off some systems.

The National Cyber Security Centre said it was working with the affected companies but told all UK businesses that the incidents “should act as a wake-up call” on the importance of having measures in place to protect against and respond to attacks.

More than £650m has been wiped off the market value of M&S since the cyber-attack. On Thursday it emerged that M&S has been forced to pause hiring new workers while tech experts dealt with the consequences of the hack.

The company said it had pulled all online job postings from its website and put its recruitment systems on hold.

M&S, which employs about 65,000 people in its stores and London head office, had no jobs listed anywhere across its UK business on Thursday despite having more than 200 openings the previous week.

Helen Dickinson, the chief executive of the British Retail Consortium, echoed Machin’s comments, saying the public should continue to support the three retailers that were hit.

“All of the businesses that have been affected are all still open,” Dickinson said in an interview with the BBC. “You can still go into the shop and buy whatever you need and I think it is really important for us as people, as customers, to support businesses when you know they are working hard to mitigate something that is completely out of their control.”

She said many retailers were concerned about the cyber-attacks, particularly given it is not yet known whether they are linked to the same group, raising fears of more attacks.

“They are obviously high profile businesses, we all interact with retailers each and every day,” Dickinson said. “Retailers need to be vigilant, but from a cyber-attacker point of view these attacks are becoming more sophisticated and they are very good at finding a weakness in any system.”