In 2025, *no brand*, regardless of its storied history or loyal following, can stand immune to cyber threats. This April, we witnessed a dramatic illustration of this reality when **Marks & Spencer**, one of Britain’s cherished high street retailers, fell prey to a series of cyberattacks.
But this incident was more than just a stunning display of large-scale criminality; it was a **searing reminder** of how rapidly a brand’s reputation can be plunged into jeopardy. As M&S continues to navigate the turbulent waters of recovery weeks on, with online orders still on hold and customer data compromised, what lessons can legacy brands glean from this fiasco?
What Really Happened?
Let’s rewind to the beginning. The trouble first arose over the Easter weekend when M&S faced issues with contactless payments and click-and-collect orders. By **April 23**, CEO **Stuart Machin** confirmed the company was grappling with a cyber incident, leading to a full suspension of online orders just two days later.
This sophisticated attack has been traced back to *Scattered Spider*, a splinter faction of the hacking group *Lapsus$*, known for targeting high-profile organizations like Transport for London and MGM Resorts. Even weeks later, M&S continues to struggle to restore its typical operations.
On **May 13**, M&S dropped another bombshell: personal customer information had been compromised, potentially exposing phone numbers, home addresses, dates of birth, and online order histories. Thankfully, no payment details or account passwords were included, but concerns about identity fraud have spiked among customers.
The financial toll is **significant**, with Bank of America Global Research estimating a staggering **£43 million** in lost sales per week. To compound matters, M&S is reportedly preparing to file a cyber insurance claim that may reach **£100 million**.
Brand Damage: An Unseen Cost
For a legacy retailer like M&S, the costs extend far beyond immediate sales losses. The ongoing disruption has placed considerable strain on **customer loyalty** and **trust**—two cornerstones of its long-established brand identity.
salarko – stock.adobe.com
With an estimated **9.4 million active online customers** affected, the reputational damage is staggering. The inability to process orders for weeks has not only enraged customers but also ignited questions about M&S’s digital readiness.
“This should serve as a wake-up call for other brands about the pressing need to build brand resilience,” asserts **Dave Mayer**, senior partner at [Lippincott](https://www.lippincott.com/). “As hacks become increasingly rampant, this sustained attack has severely strained customer loyalty for M&S.”
The Role of Brand Equity in Crisis
The silver lining for M&S is that it is viewed as a **‘comfort brand’**, loved by its consumers. “Our research indicates that comfort brands tend to be more readily forgiven when misfortunes occur,” notes Dave.
This is where **brand equity** becomes crucial. “The ability to rebound from crises isn’t built overnight,” Dave asserts. “It stems from long-term brand-building efforts that enhance **trust** and **loyalty** among consumers.” By adopting transparent communication practices, M&S has been able to navigate the storm thus far.
Sue Benson, founder of [The Behaviours Agency](https://thebehavioursagency.com/), echoes this sentiment. “While the attack has undeniably disrupted operations and sales, brand trust has shockingly remained stable,” she explains. “This resilience is a testament to M&S’s rich legacy and longstanding reputation.”
Crisis Management: Communication Is Key
However, the road ahead is still rocky for M&S. “During such moments, brand management must pivot quickly,” states **Lewis Jones**, managing partner at [Coley Porter Bell](https://www.coleyporterbell.com/). “**Transparency** becomes a brand’s most potent tool.”
He emphasizes the significance of both message content and delivery. “If a crisis hub is not user-friendly, visually inconsistent, or emotionally disconnected, the brand’s credibility diminishes further. Strong branding can impose order on chaos, signaling clarity and reinforcing identity.”
chrisdorney – stock.adobe.com
As **Charlotte Black**, chief strategy officer at [Saffron Brand Consultants](https://saffron-consultants.com/), wisely notes: “In times of crisis, revisit the original promises made to customers and maintain consistent communications. Now is not the time for storytelling diversions.”
M&S appears to be adhering to this principle, with CEO Stuart Machin personally reaching out to customers regarding the breach. His message acknowledged that “unfortunately, some personal customer information has been taken” while assuring that “there’s no evidence that this information has been shared.”
The company has been proactive, emailing website users and asking them to reset account passwords for “extra peace of mind”. This approach aligns with Charlotte’s emphasis on remaining authentic and flexible in messaging.
Learning from Past Examples
M&S’s situation isn’t unique; several brands have faced similar crises from which they can draw lessons. Sue references British Airways’ handling of its 2018 data breach, which was characterized by full-page apologies, transparency, and effective communication to reassure customers.
As M&S works tirelessly to restore its systems, the focus will gradually shift from crisis management toward rebuilding customer confidence. Dave suggests that beyond improving cybersecurity, M&S should continuously engage with customers to restore goodwill.
Five Key Lessons for Legacy Brands
Here are five crucial takeaways for brands facing similar challenges:
1. Invest in Brand Resilience Before Crisis Strikes: Trust isn’t built overnight; it arises from consistent, long-term investment in brand integrity.
2. Maintain Authentic Communication: Brands must align their messaging with established values. Authenticity is indispensable during storms.
3. Deploy Transparency as a Strategic Tool: The clarity and empathy in communication during crises can foster trust and reassurance.
4. Acknowledge Customer Impact: Directly addressing customer frustrations is essential for maintaining loyalty, especially after long periods of disruption.
5. Use Crisis as a Catalyst for Improvement: Recovery should also aim at enhancing the brand’s overall value proposition, offering unique products or services.
Conclusion
The M&S cyberattack stands as a poignant case study illustrating how legacy brands can utilize their heritage and customer loyalty during crises. While this unfortunate event has inflicted both financial and operational damage, the **deep reservoirs of trust** that M&S has cultivated over the years offer some buffer—one that newer brands might lack.
As Charlotte aptly puts it: “This is when ‘brand’ becomes a tangible asset. When businesses have the right foundational tools in place, they can steer through both prosperous and challenging times.” This incident serves to underscore that brand building is not merely about driving sales in thriving periods but about forging resilience to weather future storms. The ultimate measure of a legacy brand isn’t its ability to sidestep crises but its proficiency in harnessing accumulated trust during tough times.
In a landscape rife with evolving cyber threats, this resilience is not just beneficial; it is imperative. The M&S case illustrates that while no brand is immune to attacks, those with **solid foundations** can navigate even the gravest challenges with their core identity largely intact.
