Marks & Spencer (M&S) has announced a suspension of all online orders as it continues to address a recent cyber attack.
The retailer first confirmed a “cyber incident” on Tuesday after customers reported issues over the weekend.
Currently, M&S has halted orders across its website and apps—including groceries and clothing—and will issue refunds for purchases made on Friday.
Following news of the disruption, M&S shares dropped by 5% before partially recovering.
As of Saturday morning, online orders remained suspended.
“We are sincerely sorry for this disruption,” the company said in a post on X.
“Our specialist teams, aided by top cyber experts, are working intensively to restore online and app shopping.”
The retailer also thanked customers, employees, and partners for their ongoing patience and support.
M&S clarified that its physical stores are operating normally, despite ongoing issues with online services.
Earlier this week, the company faced further disruptions related to contactless payments, Click & Collect, and the use of gift cards.
Since online orders were suspended, M&S has continued to inform customers through social media updates about the ongoing difficulties.
“Gift cards, e-gift cards and credit receipts can’t currently be used as a payment method in store or online,” the company explained in response to a customer query on X.
However, those who have received collection notifications can visit their selected store to pick up items as normal.
“We will hold all parcels in store until further notice, so customers need not worry about returns,” the retailer added.
Nonetheless, some customers have voiced dissatisfaction with how the outage and related communications have been handled.
“Having been told yesterday evening the gift card issue was resolved, I tried again in store today but was turned away,” one customer wrote on X.
The individual noted this was the fourth consecutive day they were unable to use their M&S gift card.
Despite these challenges, some customers have commended in-store staff for their professionalism and have urged others to show consideration to workers amid ongoing difficulties.
There remains widespread uncertainty around how existing purchases, orders and returns will be addressed as M&S continues to recover from the incident.
Online supermarket Ocado, which features M&S food, is not affected, as its infrastructure is completely independent.
A spokesperson for the Information Commissioner’s Office told the BBC that M&S was “assessing the information provided” after informing the regulator of the situation.
Earlier, M&S stated it reported the matter to the National Cyber Security Centre (NCSC). The National Crime Agency shared with the BBC that it is collaborating with the NCSC to support the company.
In an update to stakeholders on Friday, M&S said the suspension of online orders was part of its “proactive management” of the incident.
“The M&S team, with leading external experts, continues to work diligently to restore online services and provide for our customers,” the company said.
As investigations continue, cybersecurity analysts are considering possible causes for the attack.
Nathaniel Jones, vice-president of security and AI strategy at cybersecurity firm Darktrace, remarked that M&S’s move to halt online sales highlights “the significant impact such attacks can have on revenue.”
He added, “This demonstrates how swiftly cyber incidents can disrupt retail, affecting both digital and in-person channels.”
William Wright of Closed Door Security noted that the attack could have substantial financial repercussions for M&S.
“Around a quarter of the company’s sales happen online, so any lengthy pause will adversely affect M&S’s finances,” he observed.
This latest cyber attack places M&S among a list of major British brands that have recently faced substantial digital disruptions.
Last year, Morrisons encountered significant issues with Christmas deliveries, with orders cancelled and discounts not applied.
In the following months, two large-scale banking outages affected customers on key paydays.
January saw serious IT failures at Barclays, impacting the bank’s app and online services; it later emerged that Barclays could face £12.5m in compensation payouts.
In February, several banks, including Lloyds, experienced outages that left many businesses unable to pay staff.
Additional reporting by Liv McMahon
Frustrated customers have also reported being unable to use vouchers and gift cards during the disruption.
M&S has confirmed it will not be renewing the lease for its Blackburn town centre store.
Feasibility studies are in progress, with local authorities planning to preserve the building’s façade.
M&S states it has been exploring opportunities to reestablish a presence in the town.
The retailer’s proposed new Hull location would reintroduce clothing and homeware departments to the city for the first time since 2019.