M&S Cyberattack Must Be Seen as Wake-Up Call for Somnolent Global Retailers

The M&S breach was a showcase of the brittle infrastructure of many legacy retailers. For all its efforts in modernising front-end services—website redesigns, app rollouts, loyalty schemes—the back-end systems at many such institutions remain outdated, under-integrated, and poorly secured.

According to Financial Times, the breach at M&S may have been facilitated in part through shared third-party software vendors. This implies a chain-of-trust problem, wherein one weak link—perhaps a vendor offering IT support or HR management platforms—can compromise the entire enterprise. It's an architectural flaw: you can build digital facades with all the latest features, but if the structural beams are rotting, the whole house collapses.

This issue is far from exclusive to British retail. Across the US, brands like Target, Home Depot, and more recently, 23andMe, have suffered breaches that stemmed not from core databases but from peripheral systems—contractor access, HVAC systems, partner APIs. These entry points are often neglected in cybersecurity assessments, even though attackers have shown time and again how they understand and exploit a roundabout route.

What’s most alarming is the laxity that allows this. M&S is a household name with deep roots in British commerce. If its internal controls can be bypassed with impersonation and password resets, what does that suggest about the readiness of mid-tier or regional retailers? Most of them lack even the scale to recover reputationally, much less financially.

And even when systems are updated, culture can lag. Legacy institutions, built around bureaucratic hierarchies, are often slower to respond to cyberthreats than leaner, more agile startups. They lack cyber-awareness at the board level, fail to invest in regular system audits, and remain skeptical of decentralising their cybersecurity governance. The result is an organisation that believes itself digitized because it has a mobile app, but in truth, it’s running a 21st-century business on 20th-century bones.

Modern retailers must accept that transformation isn't just customer-facing. It must go down to the root—network segmentation, zero-trust architecture, robust identity access management. Otherwise, all the retail innovation in the world is just expensive window dressing.

Despite the high-tech gloss often associated with cybercrime, the M&S hack was fundamentally a confidence trick. The hackers posed as employees, requested password resets from the IT help desk, and then gained access to sensitive internal systems. As The Times reported, this wasn’t even a particularly novel tactic—it was old-school social engineering, executed with conviction and good timing.

Here lies the uncomfortable truth for global retailers: no amount of firewall hardening or endpoint detection software can fully protect an enterprise if its staff can be manipulated into giving away the keys. And it’s not just frontline employees. The very culture of trust that companies encourage—between departments, within support teams, and even across vendor networks—can become a liability. Perhaps it calls for a mini vertical that is geared to strengthen just this at a person to person level.

Training programmes alone may not suffice. A whole lot of enterprises run compliance exercises that amount to tick-box routines, with little real penetration of risk awareness. The human firewall must be as rigorously maintained as the digital one. That means simulated phishing campaigns, zero-trust identity checks for internal users, and real penalties for failing security drills—not as a punishment, but as a cultural correction.

The Co-op and Harrods were also hit in what appears to be a coordinated or at least similarly timed campaign, according to Reuters. If these breaches are indeed connected, the implication is even more dire: attackers are probing an entire sector, testing for the weakest doors. This suggests that unless systemic behaviour changes occur across retail, these incidents will only multiply.

Moreover, there's an accountability vacuum. When security lapses are blamed on frontline staff, the real issue—organisational design—is overlooked. Why were help desk agents empowered to reset passwords without secondary authentication? Why was voice verification alone considered sufficient? Why weren’t the systems built with layers of escalation?

Until retailers address these questions with rigour—and redesign their workflows accordingly—they will remain vulnerable, not because they lack tools, but because they misunderstand the enemy. Cybercriminals are not merely hackers in hoodies; they are strategists with deep knowledge of human behaviour and enterprise logistics. They exploit not just bugs, but blind spots.

It is telling that in the aftermath of the M&S breach, the CEO had to publicly urge customers to “visit stores in person” while the company scrambled to restore online services. This wasn’t just a temporary outage—it was a strategic breakdown that exposed the overreliance on digital convenience without an equally robust digital defense. And it won't be the last of its kind unless companies fundamentally shift their orientation toward cybersecurity.

One of the more promising responses from M&S has been its attempt to reengineer its internal IT controls and communications strategy. According to The Guardian, the company is now undertaking a weeks-long effort to rebuild its systems—a process that will require not just software but soul-searching. Other retailers should take note, not out of sympathy, but self-preservation.

The lesson here isn't that M&S failed. It's that most retailers are no more prepared than M&S was. Too many still view cybersecurity as an IT expense rather than a strategic priority. Their boards lack cyber-literacy. Their audit committees don't include cyber-risk in regular reports. And when budgets are tight, cybersecurity training is often the first item to be trimmed.

Retailers need to understand that in the current threat landscape, compliance is not the same as resilience. You can meet every checkbox in GDPR or PCI-DSS and still fall victim to a well-executed social engineering campaign. True resilience comes from embedding cybersecurity awareness into the fabric of the business—from store managers to C-suite leaders.

Furthermore, retailers must move beyond reactive defense. Proactive threat hunting, behaviour analytics, red team exercises, and third-party vendor assessments should be standard practice. As seen in the M&S case, attackers are getting more creative, more resourceful, and more organised. Defensive strategies need to evolve accordingly—not just technically, but psychologically and culturally.

The global retail sector is undergoing a generational shift, where physical stores, digital platforms, logistics systems, and data lakes are all part of a unified, interconnected organism. If one part is vulnerable, the entire organism is exposed. As M&S discovered the hard way, no legacy is too big, no brand too trusted, and no system too complex to fail. Other retailers have two choices: learn from this breach, or become the next cautionary tale.