M&S 'had no plan' for cyber attacks, insider reveals, with staff left sleeping in the office amid 'paranoia' and 'chaos'
4 May 2025, 09:50 | Updated: 4 May 2025, 14:45
A M&S; insider has told Sky News it could be "months" before the retailer fully recovers from an ongoing, severe cyber attack - and that the company had no plan for such an incident.
Hackers have been holding the High Street brand to ransom for more than a week now, forcing it to suspend online orders and halt recruitment.
An employee at M&S;'s head office, who spoke to Sky News on condition of anonymity, said that last week had been "just pure chaos".
"We didn't have any business continuity plan [for this], we didn't have a cyber attack plan," the source said.
"In general, it's lots of stress. People have not been sleeping, people have spent their weekends working, people sleeping in the office - just reactive response."
They told Sky News it would be "a few months" before the disruption ended.
"The idea is to have some services go back online bit by bit. Not do the whole shebang, but allow the people in the store and to allow people online to have services."
Read more: Who are notorious Scattered Spider hackers?
In the meantime, they said that staff were being forced to work on personal devices in an ad-hoc manner, with internal advice constantly changing.
"We're kind of figuring it out as we go," they said.
"We're not even allowed to use our work devices, so we're having to use our personal devices, all sorts of things.
"It's just impossible to work because anything about the incident, we're not allowed to talk about on Teams, which is our usual way of chatting… So we have to use WhatsApp to talk to each other."
They said there is a "sense of paranoia and therefore not everyone knows everything, because we don't know who has been compromised. They are still trying to figure things out."
That paranoia exists because employees are still not sure whether hackers are inside the M&S; system, the source said.
"It's possible, that's a possibility," they said.
"I don't know that, and it hasn't been said. But it's a possibility and you want to be careful."
