Traumatic incident

Discussing the impact of the cyber attack, Norman said: “It’s fair to say that everybody at M&S experienced it. Our ordinary shop colleagues [were] working in ways they hadn’t worked for 30 years, working extra hours just to try to keep the show on the road. Let aside our tech colleagues, for a week, probably, the cyber team had no sleep … It’s not an overstatement to describe it as traumatic.

M&S is still rebuilding its business and expects to be doing so for some time to come, and recognising that its overall IT estate is a hodgepodge of legacy systems, Norman said the organisation is now moving up various phases of an ongoing tech refresh in the wake of the attack.

Commenting on remarks made in the House of Commons by MP David Davis that an unnamed British company had paid a significant ransom recently, Norman declined to say whether or not M&S was the organisation to which Davis was referring, and would not directly disclose whether or not the retailer had received a ransomware demand.

He said that early on, M&S had taken a decision not to communicate directly with its attackers, leaving that to cyber professionals.

Norman added that for some time, M&S did not know who had attacked it. “They never send you a letter signed Scattered Spider – that doesn’t happen,” he said. “We didn’t even hear from the threat actor for approximately a week after they penetrated our systems. You rely completely upon your security advisors to say what they think is happening, and they recognised the threat actor by the attack vector.

“Also, they communicate through the media, and in this case their chosen avenue of communication was principally the BBC. It was sometimes an unusual experience to be brushing your teeth in the morning when somebody comes onto the BBC with a communication from the people who are allegedly attacking your business.”

Social engineering

Taking further questions from the panel, Norman went out of his way to explicitly deny media reports that suggested M&S had “left the back door open”, saying the attack had occurred via social engineering via an undisclosed third-party, as has been extensively speculated over the past few weeks.

“The attack on M&S has been penned as sophisticated impersonation, in this case likely referring to the use of advanced social engineering tactics, potentially including deepfake audio or video, to convincingly pose as executives or trusted insiders,” said Richard LaTulip, field chief information security officer at threat intelligence specialist Recorded Future.

“Protecting against sophisticated impersonation attacks requires a layered approach,” he added. “While technical defences, such as multi-factor authentication and identity verification tools, are essential, the human layer remains the most vulnerable. That’s why ongoing training and executive-level awareness are critical. Employees, especially those in high-risk roles, must be educated to recognise social engineering tactics, including AI-generated deepfakes or urgent messages impersonating leadership.”