Source: www.infosecurity-magazine.com – Author:
British retailer Marks and Spencer (M&S) has informed customers and investors of a cyber incident that has affected some of its services.
In a note to investors on April 22, M&S said the company has been managing a cyber incident over the past few days.
The company confirmed it has reported the incident to the relevant data protection supervisory authorities and the UK’s National Cyber Security Centre (NCSC).
It has also engaged external cybersecurity experts to assist with investigating and managing the incident.
In a note to customers, the company informed that its click and collect services and contactless payments in stores were disrupted.
It also appears that the use of gift cards in store has been disrupted.
M&S Chief Executive Stuart Machin said in the update that to protect the business it was necessary to make “some small changes” to store operations.
Machin apologized for the inconvenience this had caused to customers and assured them there was no action they need to take at this time.
He thanked the work of the experts and M&S colleagues involved in resolving the incident.
“Can I take this opportunity to thank you for shopping with us and for your continuous support. We appreciate it,” he signed off in the note.
Comments on the post in Instagram noted that staff at many individual stores were helpful in informing customers about the in-store issues regarding payments and collections.
Others were concerned about refunds being processed and commented on not being able to pay for goods because of the issues with contactless payments.
The investor update said, “Customer trust is incredibly important to us, and if the situation changes an update will be provided as appropriate.”
In a post on LinkedIn, William Dixon, a Senior Associate Fellow for Cyber and International security at the Royal United Services Institute (RUSI), applauded the M&S customer communications about the incident.
He commented that the crisis communication to customers was “text book” and applauded the empathy, transparency and reassurance the message contained.
Commenting on the incident, James Hadley, Founder and CIO at cybersecurity training firm Immersive said, “While M&S communicated the issue clearly and has likely invoked tried and tested incident response processes, attacks like these serve as important reminders that businesses’ perception of their cyber resilience may not align with their actual capabilities.”
Meanwhile, Jamie Moles, Senior Technical Manager at ExtraHop, noted, “Incidents like this demonstrate how essential it is to have real-time visibility, threat detection and rapid response capabilities across all digital infrastructure. Network visibility can play a pivotal role, helping organizations detect anomalies early, isolate potential threats and maintain service continuity.”
Image credit: WD Stock Photos / Shutterstock.co
Original Post URL: https://www.infosecurity-magazine.com/news/ms-grapples-with-cyber-incident/
Category & Tags: –
Views: 1
