{"id":38774,"date":"2026-03-26T05:04:28","date_gmt":"2026-03-26T10:04:28","guid":{"rendered":"https:\/\/www.bbrown.com\/?post_type=insight&p=38774"},"modified":"2026-03-26T10:54:49","modified_gmt":"2026-03-26T15:54:49","slug":"marks-spencer-how-third-party-cyber-risk-can-shut-down-digital-sales","status":"publish","type":"insight","link":"https:\/\/bbrown.com\/uk\/insight\/marks-spencer-how-third-party-cyber-risk-can-shut-down-digital-sales\/","title":{"rendered":"Marks & Spencer: How Third-Party Cyber Risk Can Shut Down Digital Sales"},"content":{"rendered":"

[vc_row row_style=”page-hero” row_padding_top=”pt-0″ row_padding_bottom=”pb-5″ full_width=”stretch_row_content” css=”.vc_custom_1750779657728{padding-bottom: 200px !important;}” el_class=”bg-brand-linear-gradient-vertical”][vc_column]\n\t

\n\n\t\t
\n\t\t\t
<\/div>\n\t\t\t\t\t\t\t
<\/div>\n\t\t\t\t\t<\/div>\n\n\t\t
\n\t\t\t
\n\t\t\t\t
\n\n\t\t\t\t\t\n
\n \n

\n Marks & Spencer:
\nHow Third-Party Cyber Risk
\nCan Shut Down Digital Sales\n <\/h1>\n\t\n <\/div>\t\t\t\t\t\n\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t<\/div>\n\n\t<\/div>\n\n\t\n[\/vc_column][\/vc_row][vc_section section_padding_top=”pt-3″ section_padding_bottom=”pb-2″ full_width=”stretch_row” el_class=”overflow-visible”][vc_row row_padding_top=”pt-4″ el_class=”overflow-visible overlapping-row”][vc_column el_class=”overlapping-column”][vc_single_image image=”38792″ img_size=”1082×439″ alignment=”center” css=”” el_class=”brand-rounded-corners-right”][\/vc_column][\/vc_row][\/vc_section][vc_row row_padding_top=”pt-0″][vc_column][vc_column_text css=””]Marks & Spencer\u2019s cyber-attack illustrates how quickly a trusted brand can suffer major financial damage when third-party cyber risk is underestimated. The incident, reportedly involving ransomware and phishing activity linked to a supplier, led to a suspension of online sales and an estimated \u00a3300 million impact on profits. For a retailer with a strong digital presence, the disruption went far beyond IT inconvenience and struck directly at revenue generation.<\/p>\n

Modern retailers rely heavily on interconnected ecosystems. E-commerce platforms, payment processors, logistics partners and marketing systems often involve dozens of external vendors. While this model enables speed and scale, it also means that security weaknesses beyond the organisation\u2019s direct control can become a primary attack vector. In this case, attackers reportedly used compromised supplier access to penetrate Marks & Spencer\u2019s environment, bypassing traditional perimeter defences.[\/vc_column_text][vc_row_inner][vc_column_inner]\t

\n\t\t\t\t\t\n\t\t\t\tLearn More About Cyber Risk<\/span>\n\t\t\t<\/a>\n\t\t\t<\/div>\n[\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row row_padding_top=”pt-0″][vc_column]\n
\n \n

\n Immediate Operational and Revenue Disruption\n <\/h3>\n\t\n <\/div>[vc_empty_space height=”24px”][vc_column_text css=””]The most immediate consequence was the loss of online trading capability. Unlike physical stores, digital channels cannot operate in a degraded state. When systems are taken offline to contain an attack, revenue stops instantly. Customers faced unavailable services, delayed orders and reduced confidence in the brand\u2019s ability to safeguard their data and shopping experience. In a highly competitive retail market, even short interruptions can drive customers to alternative providers.<\/p>\n

The incident underscores a critical shift in cyber risk: the weakest link is often not internal. Third-party relationships expand the attack surface dramatically, yet many organisations still rely on periodic questionnaires or contractual clauses as their primary control. These measures rarely provide real-time insight into a supplier\u2019s security posture or detect compromise before it spreads.[\/vc_column_text][\/vc_column][\/vc_row][vc_row row_padding_top=”pt-0″][vc_column]\n

\n \n

\n Strengthening Third-Party Risk Management\n <\/h3>\n\t\n <\/div>[vc_empty_space height=”24px”][vc_column_text css=””]Effective mitigation requires a more dynamic approach. Organisations should prioritise suppliers based on criticality, access level and data sensitivity, applying deeper scrutiny where potential impact is highest. Technical controls such as least-privilege access, strong authentication and continuous monitoring of third-party connections can significantly reduce risk. Equally important is contractual clarity around incident notification, forensic cooperation and recovery responsibilities.<\/p>\n

Another key lesson lies in incident preparedness. Retailers must plan for scenarios where digital sales channels are unavailable for extended periods. This includes customer communication strategies, alternative fulfilment options and coordination with payment providers and regulators. Transparent, timely communication can help preserve trust even when services are disrupted.[\/vc_column_text][\/vc_column][\/vc_row][vc_row row_padding_top=”pt-0″][vc_column]\n

\n \n

\n Cyber Risk as a Board-Level Priority\n <\/h3>\n\t\n <\/div>[vc_empty_space height=”24px”][vc_column_text css=””]At board level, the Marks & Spencer incident reinforces that cyber risk is inseparable from commercial performance. A single cyber event can erase hundreds of millions in profit, not through stolen funds, but through lost trading days and damaged customer confidence. As digital sales continue to grow, resilience of online platforms and the security of the third-party ecosystem supporting them will remain a defining factor in retail success and financial stability.[\/vc_column_text][vc_empty_space height=”16px”][vc_column_text css=””]Click here<\/a> to learn more about managing cyber risk and building organisational resilience.[\/vc_column_text][\/vc_column][\/vc_row]<\/p>\n<\/div>","protected":false},"excerpt":{"rendered":"

[vc_row row_style=”page-hero” row_padding_top=”pt-0″ row_padding_bottom=”pb-5″ full_width=”stretch_row_content” css=”.vc_custom_1750779657728{padding-bottom: 200px !important;}” el_class=”bg-brand-linear-gradient-vertical”][vc_column][\/vc_column][\/vc_row][vc_section section_padding_top=”pt-3″ section_padding_bottom=”pb-2″ full_width=”stretch_row” el_class=”overflow-visible”][vc_row row_padding_top=”pt-4″ el_class=”overflow-visible overlapping-row”][vc_column el_class=”overlapping-column”][vc_single_image image=”38792″ img_size=”1082×439″ alignment=”center” css=”” el_class=”brand-rounded-corners-right”][\/vc_column][\/vc_row][\/vc_section][vc_row row_padding_top=”pt-0″][vc_column][vc_column_text css=””]Marks & Spencer\u2019s cyber-attack illustrates how quickly […]<\/p>\n","protected":false},"author":51,"featured_media":38792,"template":"","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"insight_category":[133],"class_list":["post-38774","insight","type-insight","status-publish","has-post-thumbnail","hentry","insight_category-thought-leadership"],"acf":[],"yoast_head":"\nMarks & Spencer: How Third-Party Cyber Risk Can Shut Down Digital Sales - Brown & Brown<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/bbrown.com\/uk\/insight\/marks-spencer-how-third-party-cyber-risk-can-shut-down-digital-sales\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Marks & Spencer: How Third-Party Cyber Risk Can Shut Down Digital Sales\" \/>\n<meta property=\"og:description\" content=\"[vc_row row_style=”page-hero” row_padding_top=”pt-0″ row_padding_bottom=”pb-5″ full_width=”stretch_row_content” css=”.vc_custom_1750779657728{padding-bottom: 200px !important;}” el_class=”bg-brand-linear-gradient-vertical”][vc_column][\/vc_column][\/vc_row][vc_section section_padding_top=”pt-3″ section_padding_bottom=”pb-2″ full_width=”stretch_row” el_class=”overflow-visible”][vc_row row_padding_top=”pt-4″ el_class=”overflow-visible overlapping-row”][vc_column el_class=”overlapping-column”][vc_single_image image=”38792″ img_size=”1082×439″ alignment=”center” css=”” el_class=”brand-rounded-corners-right”][\/vc_column][\/vc_row][\/vc_section][vc_row row_padding_top=”pt-0″][vc_column][vc_column_text css=””]Marks & Spencer\u2019s cyber-attack illustrates how quickly […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/bbrown.com\/uk\/insight\/marks-spencer-how-third-party-cyber-risk-can-shut-down-digital-sales\/\" \/>\n<meta property=\"og:site_name\" content=\"Brown & Brown\" \/>\n<meta property=\"article:modified_time\" content=\"2026-03-26T15:54:49+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/bbrown.com\/wp-content\/uploads\/2026\/03\/AdobeStock_253315203-scaled.jpeg\" \/>\n\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t<meta property=\"og:image:height\" content=\"1707\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/bbrown.com\\\/uk\\\/insight\\\/marks-spencer-how-third-party-cyber-risk-can-shut-down-digital-sales\\\/\",\"url\":\"https:\\\/\\\/bbrown.com\\\/uk\\\/insight\\\/marks-spencer-how-third-party-cyber-risk-can-shut-down-digital-sales\\\/\",\"name\":\"Marks & Spencer: How Third-Party Cyber Risk Can Shut Down Digital Sales - Brown & Brown\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/bbrown.com\\\/uk\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/bbrown.com\\\/uk\\\/insight\\\/marks-spencer-how-third-party-cyber-risk-can-shut-down-digital-sales\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/bbrown.com\\\/uk\\\/insight\\\/marks-spencer-how-third-party-cyber-risk-can-shut-down-digital-sales\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/bbrown.com\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/AdobeStock_253315203-scaled.jpeg\",\"datePublished\":\"2026-03-26T10:04:28+00:00\",\"dateModified\":\"2026-03-26T15:54:49+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/bbrown.com\\\/uk\\\/insight\\\/marks-spencer-how-third-party-cyber-risk-can-shut-down-digital-sales\\\/#breadcrumb\"},\"inLanguage\":\"en-UK\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/bbrown.com\\\/uk\\\/insight\\\/marks-spencer-how-third-party-cyber-risk-can-shut-down-digital-sales\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-UK\",\"@id\":\"https:\\\/\\\/bbrown.com\\\/uk\\\/insight\\\/marks-spencer-how-third-party-cyber-risk-can-shut-down-digital-sales\\\/#primaryimage\",\"url\":\"https:\\\/\\\/bbrown.com\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/AdobeStock_253315203-scaled.jpeg\",\"contentUrl\":\"https:\\\/\\\/bbrown.com\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/AdobeStock_253315203-scaled.jpeg\",\"width\":2560,\"height\":1707},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/bbrown.com\\\/uk\\\/insight\\\/marks-spencer-how-third-party-cyber-risk-can-shut-down-digital-sales\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/bbrown.com\\\/uk\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Insights\",\"item\":\"https:\\\/\\\/bbrown.com\\\/uk\\\/news-events\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Marks & Spencer: How Third-Party Cyber Risk Can Shut Down Digital Sales\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/bbrown.com\\\/uk\\\/#website\",\"url\":\"https:\\\/\\\/bbrown.com\\\/uk\\\/\",\"name\":\"Brown & Brown\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/bbrown.com\\\/uk\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/bbrown.com\\\/uk\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-UK\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/bbrown.com\\\/uk\\\/#organization\",\"name\":\"Brown & Brown\",\"url\":\"https:\\\/\\\/bbrown.com\\\/uk\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-UK\",\"@id\":\"https:\\\/\\\/bbrown.com\\\/uk\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/bbrown.com\\\/wp-content\\\/uploads\\\/2021\\\/12\\\/cropped-BBRetail002-RGBrevs.png\",\"contentUrl\":\"https:\\\/\\\/bbrown.com\\\/wp-content\\\/uploads\\\/2021\\\/12\\\/cropped-BBRetail002-RGBrevs.png\",\"width\":1000,\"height\":136,\"caption\":\"Brown & Brown\"},\"image\":{\"@id\":\"https:\\\/\\\/bbrown.com\\\/uk\\\/#\\\/schema\\\/logo\\\/image\\\/\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Marks & Spencer: How Third-Party Cyber Risk Can Shut Down Digital Sales - Brown & Brown","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/bbrown.com\/uk\/insight\/marks-spencer-how-third-party-cyber-risk-can-shut-down-digital-sales\/","og_locale":"en_US","og_type":"article","og_title":"Marks & Spencer: How Third-Party Cyber Risk Can Shut Down Digital Sales","og_description":"[vc_row row_style=”page-hero” row_padding_top=”pt-0″ row_padding_bottom=”pb-5″ full_width=”stretch_row_content” css=”.vc_custom_1750779657728{padding-bottom: 200px !important;}” el_class=”bg-brand-linear-gradient-vertical”][vc_column][\/vc_column][\/vc_row][vc_section section_padding_top=”pt-3″ section_padding_bottom=”pb-2″ full_width=”stretch_row” el_class=”overflow-visible”][vc_row row_padding_top=”pt-4″ el_class=”overflow-visible overlapping-row”][vc_column el_class=”overlapping-column”][vc_single_image image=”38792″ img_size=”1082×439″ alignment=”center” css=”” el_class=”brand-rounded-corners-right”][\/vc_column][\/vc_row][\/vc_section][vc_row row_padding_top=”pt-0″][vc_column][vc_column_text css=””]Marks & Spencer\u2019s cyber-attack illustrates how quickly […]","og_url":"https:\/\/bbrown.com\/uk\/insight\/marks-spencer-how-third-party-cyber-risk-can-shut-down-digital-sales\/","og_site_name":"Brown & Brown","article_modified_time":"2026-03-26T15:54:49+00:00","og_image":[{"width":2560,"height":1707,"url":"https:\/\/bbrown.com\/wp-content\/uploads\/2026\/03\/AdobeStock_253315203-scaled.jpeg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/bbrown.com\/uk\/insight\/marks-spencer-how-third-party-cyber-risk-can-shut-down-digital-sales\/","url":"https:\/\/bbrown.com\/uk\/insight\/marks-spencer-how-third-party-cyber-risk-can-shut-down-digital-sales\/","name":"Marks & Spencer: How Third-Party Cyber Risk Can Shut Down Digital Sales - Brown & Brown","isPartOf":{"@id":"https:\/\/bbrown.com\/uk\/#website"},"primaryImageOfPage":{"@id":"https:\/\/bbrown.com\/uk\/insight\/marks-spencer-how-third-party-cyber-risk-can-shut-down-digital-sales\/#primaryimage"},"image":{"@id":"https:\/\/bbrown.com\/uk\/insight\/marks-spencer-how-third-party-cyber-risk-can-shut-down-digital-sales\/#primaryimage"},"thumbnailUrl":"https:\/\/bbrown.com\/wp-content\/uploads\/2026\/03\/AdobeStock_253315203-scaled.jpeg","datePublished":"2026-03-26T10:04:28+00:00","dateModified":"2026-03-26T15:54:49+00:00","breadcrumb":{"@id":"https:\/\/bbrown.com\/uk\/insight\/marks-spencer-how-third-party-cyber-risk-can-shut-down-digital-sales\/#breadcrumb"},"inLanguage":"en-UK","potentialAction":[{"@type":"ReadAction","target":["https:\/\/bbrown.com\/uk\/insight\/marks-spencer-how-third-party-cyber-risk-can-shut-down-digital-sales\/"]}]},{"@type":"ImageObject","inLanguage":"en-UK","@id":"https:\/\/bbrown.com\/uk\/insight\/marks-spencer-how-third-party-cyber-risk-can-shut-down-digital-sales\/#primaryimage","url":"https:\/\/bbrown.com\/wp-content\/uploads\/2026\/03\/AdobeStock_253315203-scaled.jpeg","contentUrl":"https:\/\/bbrown.com\/wp-content\/uploads\/2026\/03\/AdobeStock_253315203-scaled.jpeg","width":2560,"height":1707},{"@type":"BreadcrumbList","@id":"https:\/\/bbrown.com\/uk\/insight\/marks-spencer-how-third-party-cyber-risk-can-shut-down-digital-sales\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/bbrown.com\/uk\/"},{"@type":"ListItem","position":2,"name":"Insights","item":"https:\/\/bbrown.com\/uk\/news-events\/"},{"@type":"ListItem","position":3,"name":"Marks & Spencer: How Third-Party Cyber Risk Can Shut Down Digital Sales"}]},{"@type":"WebSite","@id":"https:\/\/bbrown.com\/uk\/#website","url":"https:\/\/bbrown.com\/uk\/","name":"Brown & Brown","description":"","publisher":{"@id":"https:\/\/bbrown.com\/uk\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/bbrown.com\/uk\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-UK"},{"@type":"Organization","@id":"https:\/\/bbrown.com\/uk\/#organization","name":"Brown & Brown","url":"https:\/\/bbrown.com\/uk\/","logo":{"@type":"ImageObject","inLanguage":"en-UK","@id":"https:\/\/bbrown.com\/uk\/#\/schema\/logo\/image\/","url":"https:\/\/bbrown.com\/wp-content\/uploads\/2021\/12\/cropped-BBRetail002-RGBrevs.png","contentUrl":"https:\/\/bbrown.com\/wp-content\/uploads\/2021\/12\/cropped-BBRetail002-RGBrevs.png","width":1000,"height":136,"caption":"Brown & Brown"},"image":{"@id":"https:\/\/bbrown.com\/uk\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/bbrown.com\/uk\/wp-json\/wp\/v2\/insight\/38774","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bbrown.com\/uk\/wp-json\/wp\/v2\/insight"}],"about":[{"href":"https:\/\/bbrown.com\/uk\/wp-json\/wp\/v2\/types\/insight"}],"author":[{"embeddable":true,"href":"https:\/\/bbrown.com\/uk\/wp-json\/wp\/v2\/users\/51"}],"version-history":[{"count":0,"href":"https:\/\/bbrown.com\/uk\/wp-json\/wp\/v2\/insight\/38774\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/bbrown.com\/uk\/wp-json\/wp\/v2\/media\/38792"}],"wp:attachment":[{"href":"https:\/\/bbrown.com\/uk\/wp-json\/wp\/v2\/media?parent=38774"}],"wp:term":[{"taxonomy":"insight_category","embeddable":true,"href":"https:\/\/bbrown.com\/uk\/wp-json\/wp\/v2\/insight_category?post=38774"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}