· By Chris Kirby
The M&S cyber attack: how impersonation cost a retailer £300m
In spring 2025, one of the best-known names on the British high street was knocked sideways by a cyber attack. Online orders stopped. Some shoppers found empty shelves. And when the company's chair later explained to MPs how the attackers got in, the answer wasn't a clever piece of code. It was a person pretending to be someone else.
The Marks & Spencer attack is worth understanding even if your business is a fraction of the size, because the way in was something any business can face.
What happened at M&S
In April 2025, Marks & Spencer suffered a cyber attack that forced it to halt online orders and left some customers facing empty shelves in stores.
Giving evidence to MPs in July 2025, M&S chair Archie Norman said the attackers got in through "sophisticated impersonation". He said M&S believed the hacker group DragonForce was responsible. The company predicted the attack would hit that year's profits by around £300 million, some of which it hoped to recover through insurance (BBC).
M&S wasn't alone. Co-op also suffered an attack the same month, and told MPs that it did not pay a ransom (BBC).
"The attacker only has to be lucky once"
One of the most striking things about Archie Norman's evidence was what he didn't say. He was clear that the firm had not simply "left the back door open". M&S is a large organisation with the kind of security investment most small businesses could only dream of.
Yet, as he put it, "the attacker only has to be lucky once" (BBC).
That line sums up the challenge for every business. Defenders have to get things right every day, across every person and every system. An attacker only needs one person, on one day, to believe a convincing story.
What "impersonation" really means
When we talk about impersonation in cyber security, we mean someone pretending to be a person or organisation you trust, so that you'll do something for them. That might be handing over a password, resetting an account, approving a change or making a payment.
Security people call this social engineering. It works because it targets something no software can fully protect: the very human instinct to be helpful, especially when someone sounds like they're in a hurry or in a position of authority.
It's the reason social engineering keeps showing up in major incidents. It works on everyone, however big, however well-funded.
Why this matters for a small business
In a small business, the version of this you're most likely to meet is quieter than a headline attack, but the principle is the same. It's often a "quick favour":
- a message from someone claiming to be a colleague who's locked out and needs a password reset;
- a supplier "updating" their bank details;
- an urgent request, apparently from the boss, to approve something before the end of the day.
Small businesses can actually be more exposed to this kind of approach, not less. Teams are small, people wear several hats, and everyone knows everyone, so a request that sounds like it's from a familiar name rarely gets questioned. There's also often no IT department to pass things to.
The most important security tool in any business is a person who feels able to say, "Hang on, let me check that." A culture where it's normal to verify a request through a number or contact you already know isn't paranoia. It's just good practice, and it's free.
Where your domain fits in
Impersonation becomes much easier when a criminal can make a message look like it genuinely came from your business. If your domain's email settings are weak or missing, someone else may be able to send email that appears to come from your own address. And if you own spare or lookalike domains that aren't protected, those can be misused too.
The NCSC recommends email anti-spoofing settings (known as SPF, DKIM and DMARC) precisely because they make this kind of impersonation harder. When your email settings are strict, "it came from our address, so it must be real" becomes a much safer assumption for your staff, your customers and your suppliers.
None of this would make a business immune to a determined attacker. M&S shows that even well-defended firms can be caught out. But reducing the easy openings makes you a harder target, and for most small businesses, being a harder target than the next one is what counts.
Where do you stand?
You probably won't face a criminal gang with M&S in its sights. But you may well face someone trying to borrow your name, or a trusted contact's name, to get a payment or a password.
Tidy Cyber's free check looks at your domain and gives you a plain-English view of your email protection, website security, certificate and domain basics. It takes a minute, there's no jargon, and it tells you whether your own address would be easy for someone else to fake.