The M&S cyber attack: plan for the day systems go down
One of Britain's best-known retailers had to stop taking online orders. If it can happen to a company with M&S's resources, every business needs a plan for when — not if — something breaks.
By the Xuru Technologies team · 27 April 2025
Key takeaways
- Marks & Spencer reported a cyber incident around Easter 2025 that disrupted contactless payments and click and collect.
- On 25 April 2025 it paused online and app orders in the UK.
- Stores stayed open, but the cost of lost online sales mounted quickly.
- Every business should know how it would keep trading if its website, payments or systems went down.
Cyber attacks used to feel like a big-company problem. The lesson from this week is different: resilience — how you keep serving customers during an incident — matters as much as prevention.
What happened
As the Shropshire Star (PA) and Hargreaves Lansdown reported, M&S paused online orders through its website and app while it worked to manage the incident, after earlier disruption to contactless payments and click and collect. The company said stores remained open and customers could still browse online.
What it means for businesses
- Online sales are fragile. A paused website means lost revenue every hour.
- Communication is part of the response. Clear, honest updates keep customers' trust.
- Suppliers and staff accounts are common entry points. Help-desk and password-reset processes need care.
- Backups and offline options matter. Can you take payments, bookings or orders another way?
A simple resilience plan
| Question | Prepare |
|---|---|
| If our website goes down, what do customers see? | A status message and alternative contact route |
| Can we restore the site quickly? | Tested, off-site backups and a documented restore process |
| Who can reset admin passwords? | A verified process that resists social engineering |
| Who do we call? | A named technical partner and an incident checklist |
See our website rescue service for hacked or broken sites.
Frequently asked questions
Are small online shops targeted by hackers?
Yes. Many attacks are automated and look for weak passwords or outdated software, whatever the business size.
How often should website backups run?
At least daily for sites taking orders or bookings, stored off-site, with restores tested regularly.
What should we tell customers during an incident?
What is affected, what still works, what they should do and when you'll update them. Be honest and prompt.
Back online fast when things go wrong.
Monitoring, tested backups and a clear incident plan for your website, with a team ready to help.
Websites, payments, digital marketing, AI automation, consultancy and practical technology training — for businesses and aspiring professionals worldwide.
Saturday – Sunday: closed
Leave a Reply