M&S hit with empty shelves following cyberattack

A number of M&S stores have been left with empty food shelves as the business grapples with its ongoing cyberattack.

Apr 29, 2025 - 12:12
 0
M&S hit with empty shelves following cyberattack

A number of M&S stores have been left with empty food shelves as the business grapples with its ongoing cyberattack.

Shoppers reported issues using contactless pay and click and collect during the Easter weekend, while online orders have been paused on its app and website since Friday.

Although it remains unclear how widespread its empty food shelves are, M&S has reported “pockets of limited availability in some stores”.

Shelf stock will return to normal within a couple of days, the BBC understands, however, it will take until the end of the week before the retailer’s overall operations start to return to their normal levels.

The food and fashion giant is also handling disruption to a small amount of goods which it supplies to Ocado.

While issues regarding click and collect, contactless pay, and gift cards have now been fixed, shoppers are still unable to place online orders.



An M&S spokesperson said: “As part of our proactive management of the incident, we took a decision to take some of our systems temporarily offline.

“As a result, we currently have pockets of limited availability in some stores. We are working hard to get availability back to normal across the estate.”

It comes as M&S was warned that remote working was increasing its exposure to cyberthreats a year before the attack, The Times reported.

In its most recent annual report in June, the supermarket claimed the shift to hybrid working had made it more vulnerable to cyberattacks.

The report said the “profile of information security and overall threat landscape” for the company was changing as it continued “operating a hybrid work model”, with increased use of cloud systems and digital technology.

On Monday (28 April), M&S instructed hundreds of its agency workers from its main distribution centre to stay at home following the cyberattack.

Around 200 workers who were due to take on shift work at its East Midlands Castle Donington clothing and homewares logistics centre were told not to show up, Sky News reported.

Click here to sign up to Retail Gazette‘s free daily email newsletter