M&S Online Status After Cyber Attack & Ireland Recovery

If you’ve been trying to shop online at M&S recently, you already know something went wrong. The retailer suffered a major cyber attack in April 2025 that knocked out online orders and click & collect for weeks, leaving customers across the UK and Ireland in limbo. Here’s what we know about the recovery so far — and what it means for your next shop.

Cyber attack month: April · Irish services status: Restored click and collect · Senior discount: 10% off for over 60s · Primary service affected: Online orders · Resumption service: Click and collect

The table below summarises the key facts surrounding the M&S cyber incident and its financial fallout.

Why has M&S stopped online orders?

The M&S cyber attack began over the Easter weekend of 18–21 April 2025, initially appearing as an IT outage affecting in-store contactless payments before M&S confirmed the breach four days later. By 22 April, CEO Stuart Machin addressed morning news studios to confirm a cyber attack had shut down both online shopping and in-store click & collect services.

Cyber attack details

Security researchers traced the initial breach to a vishing call — a phone-based social engineering attack where attackers impersonated an M&S employee and convinced a third-party service desk to reset a password. From there, the hackers moved through Active Directory systems, cracked credentials, and deployed ransomware across VMware hosts. Cybersecurity experts have attributed the attack to Scattered Spider, a group known for the 2023 MGM Resorts hack, which also hit Harrods and Co-op around the same period.

Impact on services

The attack cut off online access to fashion, home, beauty, and food categories. Click & collect — a service especially popular in Ireland where customers pick up grocery and clothing orders in store — was completely suspended for weeks. Department stores remained open, but the online disruption had an immediate effect on revenue. Food sales suffered from reduced availability, while fashion and home categories lost their online sales channel entirely.

M&S proactively took down systems to contain the breach and began an emergency technology overhaul that accelerated a previously planned two-year improvement programme down to six months. The attack is now regarded as the most expensive cyber incident in British retail history.

Are M&S open for online orders?

As of early June 2025, M&S began bringing online services back incrementally. Online orders for select fashion ranges resumed on 3 June 2025 — 46 days after the initial attack — available in England, Scotland, and Wales with standard shipping and delivery times extended up to ten days.

Current UK status

According to M&S’s official cyber incident update page, fashion, home & beauty are now available for UK home delivery, with flowers and gifting also accessible. However, the full range of pre-attack services — including next-day delivery, international shipping, and certain click & collect options — remains unavailable or limited depending on region.

Instore and online options

Customers can still shop across all categories by visiting physical M&S stores, where contactless and card payments have long since returned to normal. The retailer has encouraged customers to check its official website for the latest service availability updates, noting that fuller restoration is an ongoing process rather than a single event.

Is M&S back online in Ireland?

M&S has resumed click and collect services in Ireland following the disruption. The restoration comes after weeks of uncertainty for Irish customers who rely on the service for both food and clothing orders. Reports from Irish media confirmed services were restored from a recent date, marking a significant step in the retailer’s recovery across the island.

Click and collect resumption

Irish click & collect availability has returned, allowing customers to order online and collect in store — a service that bridges M&S’s physical footprint in the Republic of Ireland and Northern Ireland. The company has maintained its Irish-facing website at marksandspencer.com/ie/ throughout the recovery period, though delivery options have been more limited than in the UK.

RTE report details

Irish broadcaster RTE reported on the restoration of M&S services in Ireland, citing the retailer confirming that click and collect was operational again. The report aligned with M&S’s broader communications about phased service restoration following the April cyber incident.

Have M&S online orders resumed?

Partial online order functionality resumed on 3 June 2025, approximately six weeks after the attack. The restoration covered standard home delivery for fashion, home, and beauty categories across England, Wales, and Scotland. Northern Ireland followed weeks later, with delivery to army base addresses taking up to two additional weeks.

Service updates

The M&S website’s cyber incident update page confirms that fashion, home & beauty are now available for UK home delivery, with flowers and gifting also restored. However, next-day delivery, international delivery, and click & collect for certain product categories remain unavailable in some regions as the retailer continues its phased return to full service.

Regional differences

Northern Ireland delivery resumed in the weeks following the June 2025 GB rollout, with some addresses — particularly those served via army bases — facing delays of up to two weeks beyond standard delivery estimates. Pre-attack delivery standards of three to five days have not yet been reinstated across all regions.

Do over 60s get 10% off at M&S?

M&S offers a 10% discount for customers aged over 60, which applies both in-store and online. This senior discount is part of M&S’s broader membership-style benefits programme, which also includes savings for students, young people, and other eligible groups.

Senior discount details

The over-60s discount provides 10% off eligible purchases and is available across most M&S product categories, including food, clothing, and home goods. The discount can be applied through the retailer’s Sparks loyalty scheme or at checkout when the relevant promotional codes are activated. The offer applies to online orders, making it accessible to customers who prefer to shop digitally. For more details on the M&S online status following the cyber attack, please see Toyota Corolla Cross 2025 Ierland.

How to apply

Customers aged 60 and over can register for the relevant M&S discount programme through the retailer’s website. Once registered, the discount is applied automatically at checkout on eligible items. The offer is available alongside other M&S promotions, though certain exclusions may apply to specific product lines or temporary sale items.

The timeline below tracks the key milestones from initial outage through to the November 2025 financial disclosure.

They picked up the phone, pretended to be an M&S employee and asked a third-party service desk to reset a password. That was it.

— Patel, Huntress cybersecurity expert (Computer Weekly)

I’m Jayne Wall, and I look after Customer Service here at M&S… some personal customer data has been taken, but there is no evidence that it has been shared.

— Jayne Wall, M&S Customer Service Lead (M&S Corporate)

The M&S cyber attack exposed a vulnerability that many retailers share: an over-reliance on third-party service providers with access to critical authentication systems. The attacker’s ability to breach M&S through a single vishing call — one phone call, one password reset — demonstrates how sophisticated social engineering has become. Scattered Spider, the group attributed to the breach, is known for targeting employees directly rather than technical infrastructure, preferring human manipulation over brute-force hacking.

For Irish customers, the recovery timeline has been mixed. Click & collect availability marks genuine progress, but the absence of full home delivery in the Republic of Ireland remains a gap that Northern Ireland customers do not fully share. The phased regional rollout means that a customer in Belfast may have access to different services than one in Dublin — a fragmented experience that retailers rarely plan for but cyber incidents inevitably create.

M&S has accelerated its digital transformation programme as a direct consequence of the attack, compressing a planned two-year technology overhaul into six months. Whether that speed compromises security rigour remains to be seen, but the financial imperative is clear: with £300 million in projected profit losses and £750 million wiped from market capitalisation, the retailer cannot afford a prolonged recovery.

Related reading: Marks and Spencer Women – 2025 Complete Guide · Elemis Pro Collagen Cleansing Balm – Review, Ingredients and Guide

M&S online services show partial UK recovery alongside full click & collect in Ireland, much like the M&S cyber attack timeline outlining the ransomware disruption and phased restoration.

Frequently asked questions