When a security decision changes a shopping day

For a customer-facing company, a cyber incident quickly becomes an operational event. On 23 April 2025, Marks & Spencer said an incident had disrupted some services. Stores remained open and customers could continue using the website and app, but the company was temporarily not processing contactless payments, paused in-store Click & Collect collection, and warned that online deliveries could be delayed. It also said it had moved some processes offline to protect customers, colleagues, partners, suppliers and the business. Source: M&S statement, 23 April 2025

That statement does not describe what happened in the incident’s first hour or identify an attack vector. That restraint makes it useful: it shows the visible effects of risk management without inventing technical detail. Customers need direct answers: can I pay, collect an order, and when will it arrive? For the business, those are simultaneous decisions about security, people, continuity of work and trust. A good decision log later becomes shared memory for recovery, review and learning.

Measure the consequences; do not guess them

In results issued on 20 May 2026, M&S reported £131.3 million of incident-related costs within adjusting items. The document does not call that figure the total economic loss. It also reported £100 million of insurance proceeds and said that the temporary pause in online trading and systems access had disrupted stock flow and availability in Fashion, Home & Beauty. Source: M&S FY 2025/26 results

The distinction between an accounting charge, insurance, lost sales and longer-term effects on relationships matters. During an incident, leaders should not compress those measures into one number. They need separate, regularly updated views of cash, orders, stock, customer services, supplier commitments and expected recovery costs.

Our analysis and recommendations

The first 60 minutes should not be a contest to produce the quickest explanation. They are a period for safe decisions that preserve options. A prepared incident team needs clear authority: who can isolate a service, who approves a manual fallback, who owns customer contact, and who records decisions. Each decision should have an owner, a timestamp, a reason and a condition for review.

The practical sequence starts with facts. The security team separates confirmed events from assumptions, preserves logs and protects evidence. Operations assesses in parallel which services remain safe and which need limits. Commercial and customer-support teams prepare a short message explaining what customers can do now, what is temporarily unavailable and where the next update will appear. Legal, finance and communications teams do not need to wait for a complete technical diagnosis before preparing their workstreams.

For every critical service, we recommend agreeing in advance on four modes: normal operation, restricted operation, a safe manual process, or shutdown. Knowing the system is insufficient; leaders need an agreed threshold for acceptable risk in payment, ordering, fulfilment and partner access. Executive leadership should approve those thresholds before a crisis, not while customers are waiting.

During the first day, create a shared operational picture: service status, dependencies, backlog volume, decisions and the next update time. This is not a public promise that recovery will finish at a certain hour. It is a disciplined way to align technical recovery with what the company can safely promise. M&S illustrates that a protective action can constrain sales; readiness determines whether the constraint becomes a managed pause or confusion.

Sources