What: TCS refutes claims of responsibility in M&S cyber security incident, asserting that none of its systems or users were compromised in the attack that suspended online operations.

Why it is important: The situation demonstrates how cyber attacks have evolved into complex investigations involving multiple stakeholders, with significant implications for retailer-vendor relationships and accountability.

Technology services provider TCS has firmly denied any involvement in the recent cyber attack at Marks & Spencer, stating that none of its systems or users were compromised. This statement comes in response to earlier reports suggesting TCS, a long-term technology partner of M&S, might have been the gateway for the attack. The incident, which began on 22 April, led to the suspension of online orders on M&S's website and app, including its click-and-collect service, affecting a channel that represents 34% of all clothing and home sales. The financial implications have been substantial, with M&S revealing in its full-year financial results that it expects a £300 million reduction in group operating profit for 2025/26.TCS's denial, delivered by independent director Keki Mistry at their annual shareholder meeting, emphasizes that no other customers were impacted, highlighting the isolated nature of the breach while raising questions about its true origin. This development adds another layer of complexity to the ongoing investigation and recovery efforts.

IADS Notes: TCS's denial of responsibility in the M&S cyber attack adds another layer to a significant retail security crisis that began in April 2025. The incident, initially attributed to human error at a third-party supplier in May 2025, resulted in a £300 million profit impact and forced a three-week suspension of online operations. The attack's severity was demonstrated by a £700 million reduction in market value and £3.5 million in daily digital sales losses. While customer recommendation rates dropped from 87% to 73%, M&S maintained relatively stable underlying trust at 82% through transparent crisis management. The breach's broader implications triggered a chain reaction across the UK retail sector by May 2025, with both Harrods and Co-op suffering similar attacks, leading to a 10% increase in industry-wide cyber insurance premiums. This situation highlights the complex challenges retailers face in managing third-party technology partnerships and securing their digital infrastructure.

M&S tech partner denies blame for cyber-attack