Marks & Spencer's half-year results to September 2026 tell two stories simultaneously. The headline — profits of £355m, up from a cyber-attack-cratered £3.4m a year earlier, total sales up 16.2% to £9.2bn — looks like a triumphant recovery. The subtext is that a single breach over Easter 2025 degraded the retailer's clothing and homewares operations for more than a year, and the business is only now returning to normal ordering processes. The mechanism is instructive. When M&S shut its website for six weeks, the immediate damage was visible. What wasn't visible was the cascading effect on its supply chain: buyers lost access to demand-forecasting technology and had to calculate orders manually. That meant chronic understocking of everyday clothing through the long hot summer of 2026, precisely when customers wanted basics. CEO Stuart Machin acknowledged M&S "did not stock enough everyday products" in some categories — a direct consequence of degraded information systems, not poor judgment. The food business carried the group. Sales rose nearly 14% to £5.2bn on the back of seven new stores, expanded locations, and a £50m investment in holding prices down on staples like meat, dairy, and fresh produce. M&S is gaining share in frequently bought grocery categories — a deliberate, capital-intensive strategy that pre-dates the hack and continued through it. The Ocado joint venture swung to a £25.6m profit from a £3.1m loss, driven by delivery efficiency gains. Clothing and homewares sales rose 17.5% to nearly £2bn, but that comparison flatters — the prior-year base was devastated by the attack. M&S itself concedes this arm remains below levels from two years ago. Profitability was further diluted by a shift toward online sales during the summer, which carry higher fulfilment costs. The company gained market share in a declining clothing market despite availability problems, which suggests the brand itself is healthy even when the operational machinery isn't. M&S is targeting £120m in cost cuts across technology, logistics, and stores this year, partly to offset £35m in costs from a new packaging levy. This is standard retail margin management, but the technology investment is now freighted with post-breach urgency. The question is whether the rebuild hardens M&S's digital infrastructure or merely restores it to the same vulnerability profile. The broader signal here matters beyond one retailer. A sophisticated cyber-attack on a major UK company produced not weeks but fourteen-plus months of operational degradation. The website came back in six weeks; the supply-chain intelligence took over a year. That gap — between restoring the visible system and restoring the invisible decision-making infrastructure behind it — is the real cost of modern cyber-attacks, and almost certainly underpriced in corporate risk models across the sector.
