Marks & Spencer has reopened its website for customers to browse online after taking the site down overnight as part of efforts to recover following a major cyber attack.
The retail giant had taken the site down in order to carry out updates, with visitors met with the message: “Sorry you can’t browse the site currently. We’re making some updates and will be back soon.”
It confirmed the site was back up and running early on Thursday morning, but for browsing only.
The group said: “Our website is open for browsing.
“As we work to get things back to normal for our customers we are doing some overnight updates.”
M&S has not been able to take online orders on its website since the Easter weekend and was left with empty shelves in many stores after being targeted by hackers in a damaging attack.
Customer personal data, which could have included names, email addresses, postal addresses and dates of birth, was also stolen by hackers.
The retail group said on Wednesday that “human error” had caused the attack, which is set to cost the firm around £300 million.
Chief executive Stuart Machin confirmed disruption could last until July.
It came as the company reported a higher-than-expected adjusted pre-tax profit of £875.5 million for the year to March, up 22.2% on the previous year.
Robert Cottrill, technology director at digital firm ANS, said it was “vital” M&S took its time to get system recovery right, in order to ensure security and prevent future incidents.
“M&S appears to be taking the appropriate and necessary steps following the cyber attack, with a likely focus on restoring core systems and recovering critical data,” he told the PA news agency.
“The extended disruption may well be a result of attackers having targeted key infrastructure, which takes time to fully assess, secure and restore.
“Given the scale and complexity of M&S’s globally connected operations, the recovery process is understandably meticulous, with multiple interconnected systems requiring scrutiny.
“It’s essential that M&S prioritises a secure and complete recovery over a rapid one.
“Rushing to bring systems back online without full assurance of their integrity could risk further compromise.
“Ensuring robust security at every layer before resumption is not just sensible – it’s vital.”
