Marks and Spencer (LSE:MKS) shares were chugging along nicely this year. Before the Easter weekend, the FTSE 100 stock had shaken off widespread market turbulence from Trump’s tariffs to reach a nine-year high above 411p per share.
But during the four-day break, the company was hit by a black swan event. It’s believed a notorious network of hackers called Scattered Spider launched a sustained cyberattack on the business. The supermarket disclosed the news on Easter Monday.
Since then, the Marks and Spencer share price has taken a beating as the retailer grapples with the havoc wreaked on its operations. With no end to the chaos over a fortnight later, how bad could things get? And is this an opportunity for brave investors to buy a cheap stock today?
What we know so far
Details are emerging about the precise nature of the “cyber incident” that M&S has confirmed it’s dealing with. We know that the firm fell victim to a ransomware attack. This type of malicious software prevents access to computer systems and holds critical data hostage until a ransom’s paid.
The fallout’s been severe. Online orders have been halted for more than a week thus far. Shoppers have been warned it may take months before normal service returns. To add to the misery, recruitment‘s been paused, and automated storeroom checks have been disrupted, leading to significant waste.
Cybersecurity risks are a threat to many companies in the internet age. However, this cyberattack seems to be particularly bad. As huge disruption persists and reputational harm mounts, there could be lasting damage to the M&S brand.
Sinking share price
Investors who put £10,000 into Marks and Spencer shares before the cybergang struck would have been able to buy 2,431 shares. Today, that position would have shrunk to £8,710.27. That’s a painful loss of nearly £1,300 in under three weeks.
The Marks and Spencer share price is still up 37% over 12 months and 277% over five years. In this context, the cyberattack has yet to inflict really serious damage on long-term shareholders. Nevertheless, I think there’s a strong chance things could get worse.
Uncertain outlook
The big problem for the group and investors alike is uncertainty. It’s worrying that M&S appears to have been completely blindsided by the cyberattack. The response has been largely reactive so far.
Scattered Spider may have been behind similar cyberattacks in 2023 against US casino operators, Caesars Entertainment and MGM Resorts International. The former reportedly paid a negotiated $15m extortion payment while the latter suffered around $100m in losses after refusing ransom demands.
Unfortunately, M&S seems stuck between a rock and a hard place. There’s no easy way out for a business where ongoing disruption is causing daily damage to the bottom line.
Before this crippling incident, results were encouraging. In the third quarter, revenue advanced 6.4% to £3.9bn. Both the clothing, home, and beauty division and the food business were in positive shape, with sales rising by 1.9% and 8.9%, respectively.
Marks and Spencer shares offer exposure to a fundamentally high-quality retail group with substantial potential. But the latest developments should give investors pause for thought. I won’t be investing until the company can show the cyberattack’s under control.
