M&S cyber attack exposes gap in CX strategy

Over the weekend, shoppers at Marks & Spencer’s flagship Marble Arch store were met with a surprising sight: empty food shelves and handwritten notices apologizing for “technical issues.” The culprit is a sophisticated cyberattack that has disrupted the operations of one of the UK’s most respected retail brands and posed a major test of its customer experience (CX) resilience.

M&S cyber attack’s digital disruption leads to physical impact

The attack is linked to the Scattered Spider hacking group and has impacted M&S across multiple touchpoints. In-store, customers have found key products missing, while online shoppers are still unable to place orders through the website or app. Click & Collect services, gift cards and the Sparks loyalty program were also affected at the height of the disruption.

Though M&S has since restored some functionality, core systems related to food availability remain under pressure. In several stores, including Marble Arch, signage has been used to explain the limited stock levels. The company has yet to confirm the full scope of the disruption, but estimates suggest that food supply should return to normal by the end of the week.

For a business whose transformation strategy has leaned heavily on digital innovation and omnichannel engagement, this event couldn’t have come at a worse time - just as consumers begin to stock up for warm-weather entertaining.

Customer communication more important than ever

From a customer experience perspective, the cyberattack has placed M&S in a difficult position. Customers expect seamless service and when that breaks down, proactive communication becomes essential. Many took to social media to voice frustration over the lack of updates, cancelled orders and missing loyalty perks.

For example, Nayna McIntosh, former M&S executive and founder of Hope Fashion said: “The worst thing a brand can do during a crisis is stay silent. Customers don’t expect perfection, but they do expect clarity.”

While store colleagues have been praised for their professionalism on the ground, M&S’s broader crisis communication has drawn mixed reviews. Customers appreciate empathy and reassurance, but only when paired with timely, actionable updates.

Shares fallen by 7 percent

The disruption has also had significant operational and financial implications. Online sales, which account for nearly one-third of M&S’s clothing and homeware revenue, have been halted since Friday, at an estimated cost of £3.8 million per day. Shares fell 7 percent in the wake of the incident, with approximately £700 million in market value lost.

Meanwhile, up to 200 agency workers at the Castle Donington distribution center were sent home because of reduced warehouse activity. Food deliveries to Ocado, M&S’s online grocery partner, have also been disrupted.

The company has enlisted cybersecurity specialists CrowdStrike, Microsoft and Fenix24 to investigate the breach and rebuild digital integrity. According to The Times, attackers may have gained access to internal systems critical to domain-level controls, a potentially serious, long-term vulnerability.

Turning a CX crisis into an opportunity 

Despite the severity of the incident, M&S still has a window of opportunity to reaffirm its commitment to customer trust. Experts agree that recovery hinges not just on resolving technical issues but on how well the company navigates the emotional dimension of customer experience.

“This is a moment for leadership, not just in IT but across the entire customer value chain,” said a CX strategist advising UK retailers. “Customers will remember how they were treated during the disruption far more than the disruption itself.”

Brands that weather crises well typically do so by being transparent, accessible and, most importantly, human! M&S’s well-established brand equity could provide a buffer, but sustained inaction or poor communication could erode that goodwill quickly.

Quick links:

• Amazon CEO: "AI is reinventing CX"
• Chatbot hallucination at Anysphere sparks customer backlash and subscription cancellations
• JPMorgan Chase sues customers for fraud

All Access: AI + Data 2025

Join us to hear from industry leaders, innovators, and CX experts as they share insights, strategies, and tools for harnessing customer feedback to drive meaningful change. 

Register Now