M&S warehouse workers told not to come to work following cyberattack

Avatar

British retailer Marks & Spencer (M&S) has told hundreds of workers not to turn up at its main warehouse distribution centers as it continues to respond to a cyberattack.

It follows the company — which has more than 1,400 stores worldwide and made a profit before tax last year of £672 million ($896 million) — announcing on Friday that it was pausing all online shopping three days after it initially announced it was managing a cyber incident.

Roughly 200 agency workers who had been set to complete shifts at M&S’s logistics centers were told not to come into work, as reported by Sky News, which described the incident as an “escalating crisis.”

A spokesperson for M&S did not dispute the Sky News report. It is understood that shifts have only been cancelled for agency staff, who comprise about 20% of the warehouse workforce, and not full-time M&S employees.

In its latest statement, issued Friday, the retailer said it was “truly sorry for this inconvenience” but told customers its stores remained open.

M&S shares dropped 2% on Monday morning, compounding a 6% drop last week following its notification of the cyberattack to the London Stock Exchange.

The company said: “Our experienced team — supported by leading cyber experts — is working extremely hard to restart online and app shopping. We are incredibly grateful to our customers, colleagues and partners for their understanding and support.”

IndustryNewsCybercrimeNews Briefs
Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Alexander Martin

is the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and is also a fellow at the European Cyber Conflict Research Initiative.

 

Total
0
Shares
Previous Post

⚡ Weekly Recap: Critical SAP Exploit, AI-Powered Phishing, Major Breaches, New CVEs & More

Next Post

Ukrainian state and banking services restored after data center outage

Related Posts

Third Parties and Machine Credentials: The Silent Drivers Behind 2025’s Worst Breaches

It wasn't ransomware headlines or zero-day exploits that stood out most in this year's Verizon 2025 Data Breach Investigations Report (DBIR) — it was what fueled them. Quietly, yet consistently, two underlying factors played a role in some of the worst breaches: third-party exposure and machine credential abuse. According to the 2025 DBIR, third-party involvement in breaches doubled
Avatar
Read More

SonicWall Patches 3 Flaws in SMA 100 Devices Allowing Attackers to Run Code as Root

SonicWall has released patches to address three security flaws affecting SMA 100 Secure Mobile Access (SMA) appliances that could be fashioned to result in remote code execution. The vulnerabilities are listed below - CVE-2025-32819 (CVSS score: 8.8) - A vulnerability in SMA100 allows a remote authenticated attacker with SSL-VPN user privileges to bypass the path traversal checks and delete an
Avatar
Read More