M&S pegs cyber cleanup costs at 136M, profits tumble

"M&S said £83 million ($108.2 million) was spent on "immediate systems response and recovery," while the other expenses are connected to legal and other professional services. Much of these costs will be offset by the maximum £100 million ($130.3 million) claim M&S made on its cyber insurance policy, as referenced in May's 2025 profit and loss accounts and reiterated in today's results."

"The attack hammered profits, which fell 55.4 percent year-on-year to £184.1 million ($240 million). The retailer had warned in May that the attack could cost £300 million ($391 million) by year-end. The heavy hit to the bottom was largely attributed to the digital break-in, however, a packaging disposal levy - a new requirement for large businesses to cover the costs of expunging and recycling their packaging - added more than £50 million ($65.1 million) in additional costs."

Marks & Spencer expects its April cyberattack to cost around £136 million in total, recording £101.6 million of charges in the six months to Sept 27 and expecting a further £34 million in the second half. £83 million went to immediate systems response and recovery, with additional legal and professional fees. A maximum £100 million cyber insurance claim will offset much of the cost. Profits fell 55.4% to £184.1 million. A packaging disposal levy added more than £50 million in costs. Revenues rose 22.1% to £7.96 billion, online disruptions cut fashion, home and beauty sales and food profits fell 58.8% due to markdowns and waste.

Read at Theregister