The M&S hack is a brand attack

The M&S hack has battered not only the retailer’s computer systems and business it has also battered its brand.

The hack by a global hacking group rumoured to be called ‘Scattered Spider’ is costing the store group £43m a week estimates from the Bank of America claim and it has brought M&S’ computer operation to its knees, stripping its shelves of products, and visibly hit the group’s reputation.

According to a BBC report, damage from the hack, which surfaced exactly a month ago, and was exclusively revealed by Future Intelligence (Fi) on LinkedIn, will last until July and cost the company around £300m, but the damage is deeper because of M&S’ reputation.

The attacks on high-street household names have had a greater impact on the UK national psyche than similar hacks on British Airways and the British Library for the simple reason that people can see the results on the shelves of the retail chains.

Police promise manhunt for criminals

As a result, UK police have publicly committed to hunting down the criminals.

“We are looking at the group that is publicly known as Scattered Spider, but we’ve got a range of different hypotheses, and we’ll follow the evidence to get to the offenders,” said Paul Foster, head of the NCA’s national cyber-crime unit.

“In light of all the damage that we’re seeing, catching whoever is behind these attacks is our top priority,” he added.

According to a top company insider M&S, had no continuity plan for an cyber-attack: “We didn’t have any business continuity plan [for this], we didn’t have a cyber-attack plan,” the source said in an off the record interview to Sky TV.

Is M&S hack a line in the sand?

Yet according to experts interviewed on Fi’s new television arm TechTV, all of these incidents are combining to mark a watershed in cyber-attacks and the public perception of them, because of a growing frustration that companies do not care about their customer’s most intimate asset, their data.

Speaking on the TechTV panel Salford University’s Professor of Marketing Vish Maheshwari, said: “I think this connects to a softer piece of consumer psychology, if you look at the way it effects in the trust built in the brand.

“It’s not any old cyber attack, it’s an M&S cyber attack”

M&S customer

“If your consumers and customers are looking at the company, the organization, and even the people at the at the top and thinking they all are fully aware of scenarios whether it be technological development or issues like cyber-attacks.

“It certainly gives you satisfaction as a consumer, thinking I’m in the right hands if my data is in the right hands, I am dealing with the correct organization, where everybody’s fully aware.  

M&S had no cyber attack response plan

“In this case particularly in M&S, whether there was a backup plan, or not, I think the key point was that employees were not ready for this. They were not trained to deal with this, whether it the top board or whether the middle level managers or the shop floor managers, they were just not prepared.

“The biggest lesson they could learn from this is to ensure full awareness of the impact it could have on their brand. To come out of this well I think how that plays into the consumer psychology will play a part in its rebuilding.

“At the moment the data says only 7 to 9% brand trust has been lost for M&S and that’s not massive.”

But as Ross Brewer, vice-President of the cyber security company Graylog, pointed out on the TechTV panel, cyber security incidents take a while to unravel.

“With cyber incidents with big retailers in the US what happened was the cyber security incident started to get shareholders questioning the executive’s decision-making processes and their professionalism. Then you go back six months later, and the chief executive officer’s gone, the chief information office is gone, and the chief information security officer is gone.

The sting in the tail

“So, all these executives on tens of millions of dollars lost their roles because of a cyber incident and that was the start of it because it started to call into question other things about the management team. So, I think executives must be really careful about this because it does have a long tail and it’s got a sting in it.”

A shareholder response that is increasingly being shared by customers weary of repetitive cyber-attacks.

A straw poll by Fi across the country found that customers saw the attack on M&S and the store groups collapse as one step too far on the high street.

A hack on a High St sycamore tree?

“It really has been an epic fail,” said a woman shopper passing the Loughborough M&S. “It’s unbelievable that they had no plan. They are having a mare.”

Another M&S shopper in Manchester confided that she and her daughter were going into the shop for a bra fitting.

“I know it might sound silly, but that’s intimate, personal, information and they store that online and I would not be comfortable with that being in the hands of a stranger.

While another woman in Ipswich said that the attack had hit at M&S’ reputation.

“I go in there for school blouses and bras for my daughter. The last time I went in they offered me a loyalty card, after this I am glad, I declined. I always went there for undies because you can rely on them being in stock and having something you will want.

“It’s dependable, they had a currency exchange and a food hall and most importantly they had a toilet. I went in there because it’s a dependable, reliable place. Having a cyber-attack makes them just like anyone else.”

A direct attack on M&S’ advertising branding slogan of: “It’s not any food, it’s M&S food,” according to one male shopper, who quipped; “It’s not any old cyber-attack, it’s an M&S’ cyber-attack.”

Fi did contact M&S to ask for a spokesperson for a comment, but neither at the time of broadcasting, or of printing had received a response.

To watch the TechTV discussion of the damage the hack has done to M&S’ reputation click on the image below

(The names of the M&S customers are known to us but for privacy reasons we are keeping them confidential)