M&S cyber insurance stayed at £100m as attack costs head for £134m

• Marks & Spencer recognised no insurance income from its 2025 cyber incident in the 26 weeks to 26 September 2026, against £100.0m in the same half a year earlier.
• Direct incident costs were £0.3m in the half, and M&S expects about £2.0m more in the second half, "taking total costs to c.£134m".
• M&S said Fashion, Home & Beauty sales and profit were still below 2024/25, partly because of "the long-tail impact of the incident". The ICO investigation continues.

The insurance income Marks & Spencer has recognised for its cyber incident has stayed at £100m while its direct costs from the April 2025 attack head for about £134m, its interim results show, and the retailer says the incident is still weighing on its clothing and home business.

For buyers of large cyber programmes, the figures put numbers on the gap between a policy limit and the cost of a long outage. They also show that direct response costs are only part of the bill: the trading hit to Fashion, Home & Beauty (FH&B) runs on in a period with no insurance income.

In its results for the 26 weeks to 26 September 2026, published on 4 November, M&S showed insurance income of nil, against £100.0m in the first half of last year and £100.0m for the full year to 28 March 2026. The income relates to the cyber incident and is recognised within other operating income.

Costs associated with the incident were £0.3m in the half, against £101.6m a year earlier and £131.3m for the last full year. M&S said these were incident-related legal and advisory costs, and that "further charges of c.£2.0m are expected in the second half of the financial year, taking total costs to c.£134m". It treats them as adjusting items, outside adjusted profit.

That total does not cover lost trading. M&S said FH&B "sales and profit remained below 2024/25", which it put down to "availability disruption reflecting the long-tail impact of the incident and lower store sales during the prolonged summer heat". FH&B adjusted operating profit was £150.5m, a margin of 7.5%, against £243.4m two years ago, on sales of £1,995.4m against £2,030.5m. M&S expects FH&B to improve in the second half as availability has recovered.

M&S chairman Archie Norman told the Retail Technology Show in London in April that the company's cyber cover had a £100m cap. "Our cap was £100 million, and we received it," he said, as reported by Retail Systems. He urged retailers to "insure for the catastrophe".

Regulatory exposure is still open. In its contingent liabilities note, M&S said that "as at 3 November 2026 M&S continues to cooperate with the investigations of the ICO and other relevant regulators".

Related coverage: Insurers warn spoilage from fridge hacks may fall outside cover, NCSC: four routes behind 88% of large-firm incidents it handled.

Sources

• Marks and Spencer Group plc: interim results for the 26 weeks ended 26 September 2026 (RNS, 4 November 2026)
• Marks and Spencer: interim results press release
• Retail Systems: Cyberattack felt like "immersion in another world", says M&S chair
• Assured: Archie Norman, M&S chairman, "Insure for a cyber catastrophe" (23 April 2026)

CoverWire is a news and information service. Nothing here is investment advice.