Marks & Spencer cyber attack latest: Contactless payments at M&S stores still down as disruption continues

In a statement issued Thursday, the retailer said: “We are not currently processing contactless payments” and added that it has also temporarily suspended in-store collection for click and collect orders. Customers may also experience delays in online deliveries.

The company revealed it has made “minor, temporary changes” to its store operations as a precaution. “We have made the proactive decision to move some of our processes offline to protect our colleagues, partners, suppliers and our business,” M&S said.

While stores remain open and customers can still shop via the website and app, the ongoing disruption has continued to frustrate shoppers. The high street giant issued an apology earlier in the week and reiterated its gratitude today.

“We are incredibly grateful for the understanding and support that our customers, colleagues, partners and suppliers have shown. We are working hard to restore our services and minimise disruption and are being supported by industry-leading experts.”

In an email to customers earlier this week, M&S chief executive Stuart Machin said: “I’m writing to let you know that over the last few days M&S has been managing a cyber incident. To protect you and the business, it was necessary to temporarily make some small changes to our store operations, and I am sincerely sorry if you experienced any inconvenience.”

Machin added that “our stores remain open, and our website and App are operating as normal,” and reassured customers that “there is no need for you to take any action at this time.” However, he acknowledged that “there may be some limited delays to your Click & Collect order, which we are working hard to resolve.”

The issue reportedly led to contactless payment failures and disrupted the ability of customers to collect online orders over the weekend. M&S has since restored contactless payments in stores, but Click & Collect orders and some returns services remain affected.

The company has launched an investigation with cybersecurity experts and is working with the National Cyber Security Centre (NCSC) and data protection supervisory authorities to manage the incident.