![](\"https:\/\/www.insurancejournal.com\/app\/uploads\/2025\/04\/marks-and-spencers-logo-bloomberg-580x387.jpg\"){kind=logo}
<\/p>\n![](\"https:\/\/www.insurancejournal.com\/app\/uploads\/2025\/04\/marks-and-spencers-logo-bloomberg.jpg\"){kind=logo}
<\/div>\nA ransomware attack is the cause of a disruption at Marks & Spencer Group Plc., with hackers using a potent kind of malware to lock down some of the British retailer\u2019s systems and render them inaccessible, according to people familiar with the attack.<\/p>\n
The company has for more than a week attempted to recover from what it\u2019s called a \u201ccyber incident,\u201d pausing online orders and stopping processing some payments in its stores across the UK. A group of suspected cybercriminals hit the company with a kind of ransomware known as DragonForce, according to two people familiar with the matter, who spoke on condition of anonymity as they were not authorized to share information about the investigation.<\/p>\n
Attackers use DragonForce ransomware to encrypt files on victims\u2019 computers, then demand payment in cryptocurrency to unlock them, according to cybersecurity experts. The creators of DragonForce, whose identities aren\u2019t known, operate like a criminal cartel, leasing out their malicious software and infrastructure to other hackers while taking a cut of any proceeds earned through extortion, experts say.<\/p>\n
A spokesperson for M&S declined to comment on the ransomware or the identity of the hackers. It\u2019s not clear whether the hackers have demanded payment from M&S, or whether M&S is engaging in any kind of negotiation.<\/p>\n
M&S has hired external cybersecurity experts to assist with investigating and managing the incident. \u201cWe are taking actions to further protect our network and ensure we can continue to maintain customer service,\u201d the company said in a statement.<\/p>\n
Marks & Spencer shares have fallen 6.2% in London since the incident was reported on April 22.<\/p>\n
Hackers working with DragonForce claimed more than 90 victims last year and targeted companies across various industries, including health care, manufacturing and telecommunications, according to Broadcom\u2019s cybersecurity unit Symantec. The attacks spanned more than a dozen countries across North America, Europe, the Middle East and Asia, according to cyber experts.<\/p>\n
M&S, which has more than 1,000 stores in the UK, said in a statement on April 22 that it was unable to process contact-less payments and that \u201cclick and collect\u201d orders had been disrupted. The company also halted online orders and they have yet to resume.<\/p>\n
There have been reports of gaps on shelves as the company struggles with availability for some items. Hundreds of agency staff at M&S\u2019s main clothing and home warehouse were told<\/a> not to come in on Monday as the company battles the problem, Sky News reported.<\/p>\n With temperatures currently rising in the UK and online orders shut down for a fifth day on Tuesday, the cyber incident means that M&S is missing out on online sales of its Spring-Summer range.<\/p>\n \u201cI\u2019m sure demand for summer clothing is probably going up this week,\u201d said Kate Calvert, an analyst at Investec. \u201cThere will be an impact on first quarter profits without a doubt.\u201d<\/p>\n The retailer prides itself on offering consumers a so-called \u2018omnichannel\u2019 approach where they can buy both in stores and online. Online makes up the smaller proportion of the business, with web or app-based sales accounting for about 30% of the retailer\u2019s UK clothing and home sales last year, but the longer online orders are halted the more it weighs on the business.<\/p>\n Photograph: The Marks & Spencer Group logo. Photo credit: Chris Ratcliffe\/Bloomberg<\/em><\/p>\n Related:<\/strong><\/p>\n Topics<\/span> Cyber<\/a> <\/p>\n<\/p><\/div>\n Was this article valuable?<\/p>\n<\/p><\/div>\n