British retailer Marks & Spencer (M&S) announced on Wednesday that a "highly sophisticated" cyberattack is expected to cost it around £300m, or approximately $403m, in operating profit. The disruption is expected to continue until July.
The attack, which hit one of the UK's most iconic brands, employing 64,000 people and operating 565 stores, sent shockwaves throughout the retail sector. It has crippled online clothing sales, caused shortages in some food aisles and wiped over £1bn off M&S's market value.
Before the incident, the company was performing well. Now, online sales will remain partially suspended throughout June and will not resume fully until July, as systems are brought back online.
The food department has been particularly affected by reduced product availability and increased costs related to waste and logistics as a result of the temporary return to manual management. While supply has since improved, the fashion, home and beauty divisions will continue to suffer the consequences of the interruption in online sales, both in terms of revenue and profits.
Physical stores, meanwhile, "have shown resilience," the company said.
Chief Executive Stuart Machin said that M&S has overcome many challenges in its 140-year history. "This incident is just a setback. We will emerge stronger, determined to continue our transformation for the benefit of our customers, employees and shareholders," he said. He praised the "unwavering support" of customers and expressed his deep gratitude for their patience and trust.
The company revealed the attack on April 22, then suspended orders for clothing and homewares on its website and app three days later. It also confirmed last week that some customer personal data had been stolen.
With other British retailers such as Co-op and Harrods also targeted, and Google (Alphabet) recently warning of attacks now targeting US companies, retailers around the world are stepping up their cybersecurity measures.