Marks & Spencer (M&S), the British multinational retailer with over 1,400 stores and 64,000 employees worldwide, has confirmed it is managing a cybersecurity incident that has disrupted some of its services, particularly its Click and Collect system.

In an official statement released on the London Stock Exchange, M&S acknowledged the situation: “Marks and Spencer Group plc has been managing a cyber incident over the past few days. As soon as we became aware of the incident, it was necessary to make some minor, temporary changes to our store operations to protect customers and the business.”

The company has implemented temporary operational changes while working with external cybersecurity experts to investigate and contain the incident. M&S has also notified relevant authorities, including data protection supervisory authorities and the National Cyber Security Centre.

While stores remain open and the website and app continue to function normally, customers using the Click and Collect service have been advised to wait for confirmation emails before visiting stores to collect their orders.

The retailer has apologized to affected customers for any inconvenience, assuring them that efforts are underway to resolve the issues and restore normal service. The specific nature of the cyber incident has not been disclosed, and no threat actors have claimed responsibility for the attack.

If ransomware is involved, as is often the case in similar incidents, customer data may have been compromised and could potentially be used as leverage in extortion attempts.