Cyber attack causes further chaos for M&S shoppers

M&S shoppers are facing further frustration at the checkout as the company struggles to recover from a cyber attack.

Customers began reporting problems on the weekend, with the retailer confirming on Tuesday it was dealing with a "cyber incident."

It told the BBC on Wednesday that customer-facing systems were back to normal.

However, it has since confirmed it has been forced to take some systems offline as part of its "proactive management of the incident."

It said it had stopped processing contactless payments, had paused the collection of click and collect orders in stores, and warned of delays to online order deliveries.

Contactless payments have since been restored, the BBC has been told, however this has been questioned by some customers.

BBC staff have described witnessing the impact of the suspension of contactless payments.

At Euston station, in London, shop staff were seen shouting that it was cash only as the payments system was down. Disruption was also seen in Glasgow, and a store at Edinburgh Haymarket seemingly closed early.

M&S says it had made the "decision to move some of our processes offline to protect our colleagues, partners, suppliers and our business".

But stores remain open and customers could "continue to shop on our website and our app", the statement added.

But confusion has reigned on social media amongst M&S customers.

The firm has responded to some posts on X (formerly Twitter) in the past few hours advising customers contactless payments can be taken in stores

However, this has been contradicted by some individuals, with one saying: "That is wrong - only chip and pin or cash is working".

M&S also told click & collect customers not to travel to a store "until they have received their 'Ready To Collect' email".

Some customers also questioned that, with one person saying after receiving their email, "store staff said they are unable to retrieve the item"

The company has declined to provide detail on the nature of the attack, but moving systems offline is often a response to ransomware attacks.

On Tuesday the firm said in a notice to investors that it had engaged "external cyber security experts to assist with investigating and managing the incident.

"We are taking actions to further protect our network and ensure we can continue to maintain customer service," it added.

The company said it also reported the incident to the National Cyber Security Centre which told the BBC it was "working with Marks and Spencer to support their response to a cyber incident".

The National Crime Agency told the BBC its officers were "working alongside partners in the NCSC to better understand the incident and support the company".