Marks & Spencer: 300 million of impact, 100 million of cover

In April 2025 an attack that began with a password reset at an outsourced help desk stopped Marks & Spencer's online orders for 46 days, with an estimated impact of 300 million pounds and cyber cover of up to 100 million. The analysis: limit and loss, the help desk, aggregation by actor and questions for renewals.

Archive: reconstruction written in November 2026

Topic of the month, April 2025 · by cybercoverinsurance

In April 2025 Marks & Spencer, one of the largest UK retail chains, suffered an attack that stopped online orders for 46 days, emptied some shelves and led to the theft of customer data. In May the company estimated an impact of about 300 million pounds on the year's operating profit. According to the Financial Times, the claim on its cyber policy was capped at 100 million.

The case is useful for cyber underwriters because the numbers are public: the estimated impact, the direct costs and the maximum insured amount. It shows the gap between the economic loss of a large retailer and the cover the market offers, and the weight of an outsourced help desk as the way in.

What is known

The way in. Chairman Archie Norman told the UK Parliament that entry happened on 17 April through a "sophisticated impersonation": the attackers, with an employee's details, convinced a third-party supplier to reset that employee's password. According to BleepingComputer's sources, actors linked to Scattered Spider then encrypted numerous VMware ESXi servers with DragonForce ransomware and took about 150 GB of data. Norman declined to say whether a ransom was paid (BleepingComputer).

The outage. The attack came around the Easter weekend. M&S disconnected warehouse and online ordering systems. On 13 May it confirmed the theft of customers' personal data. On 10 June, after 46 days, it resumed online orders for some clothing ranges, with standard delivery only. At its lowest point the share price had lost about 16%, more than 1 billion pounds of market value (The Register). Click and collect returned in August (The Record).

The May estimate. On 21 May M&S indicated a fall in operating profit of about 300 million pounds for the year, to be reduced through cost management, insurance and other actions. The stolen data included names, email addresses, postal addresses and dates of birth. Waste and logistics costs rose because of the switch to manual processes (PA via Hargreaves Lansdown).

The cover. According to the Financial Times, as reported by IADS, the insurance payout could reach 100 million pounds. Allianz was the primary insurer for the first 10 million, with Beazley among those exposed (IADS).

The bill in November. In its half-year results on 5 November 2025 M&S booked 101.6 million pounds of charges for the incident, 83 million of them for systems response and recovery, and expected another 34 million in the second half, about 136 million in total. Adjusted profit for the half fell 55.4% to 184.1 million (The Register). Statutory profit before tax went from 391.1 million to 3.4 million, with the 100 million insurance payment softening the blow (The Record).

Later developments. In July 2025 four people were arrested over the attacks on M&S, Co-op and Harrods (The Record). In October 2025 M&S ended its IT help desk contract with Tata Consultancy Services. TCS said it found no indicators of compromise in its own network, and both companies said the decision predates the attack (Retail Systems).

What is not known. Which supplier was deceived, whether a ransom was paid and the details of the policy (limits, retentions, indemnity period) have not been made public.

The loss and the cover

One third of the impact, at most. Against an estimated 300 million pounds of lost operating profit, the maximum claim on the policy was 100 million. Even in the best case, two thirds of the estimated impact stayed with the company. It is one of the best documented cases of a large group being underinsured against its own worst cyber scenario.

Direct costs are close to the limit. The declared direct costs, about 136 million, on their own already exceed the maximum insured. The business interruption part, meaning lost online sales and reduced margins, remains almost entirely uncovered. For underwriters, the question is not only how much the limit is worth, but which part of the loss consumes it first.

The limit reflects the market, not the scenario. A chain with 13.8 billion pounds of annual revenue is unlikely to find cyber capacity matching its worst scenario. The M&S case shows that large groups must decide explicitly how much cyber risk to retain, rather than discover it after the claim.

The help desk is the perimeter

The reset password is the door. The attack did not exploit a technical vulnerability, but the credential reset procedure. Whoever runs the help desk, in-house or outsourced, decides who can obtain new access. It is the same pattern as Transport for London in 2024, also attributed to members of Scattered Spider.

The outsourced supplier brings the risk inside. The help desk was run by a third party, with the power to reset passwords. Questionnaire items on multi-factor authentication and training are not enough if identity checks over the phone are weak. Underwriters need to know how the supplier verifies callers, especially for privileged accounts.

Recovery from the supplier is uncertain. TCS denied that the compromise started from its network. For M&S's insurer, subrogation against the help desk supplier depends on evidence and contracts that are not public, and is in any case limited by contractual liability caps.

Aggregation by actor and by sector

Three retailers in a few weeks. The July arrests concern the attacks on M&S, Co-op and Harrods (The Record). Linked attacks, using the same technique, hit one sector in sequence. For a portfolio, aggregation runs not only through a shared supplier, but also through an actor that picks a sector.

The competitor gains, the insurer does not. Next reported sales up 7.6%, partly due to competitors' difficulties (The Record). A retailer's loss does not vanish from the market, but for an insurer covering many retailers in the same area, the sequence of attacks matters more than the single event.

What to bring to renewals

Impact for insurersHigh

An attack that started with a password reset at an outsourced help desk stopped a large retailer's online sales for 46 days, with an estimated impact three times the maximum insured.

On the portfolio side, the case suggests treating retailers in the same area as a group exposed to the same actor, and asking who provides the help desk: the same supplier serving several insureds is an aggregation point worth knowing.