Some M&S stores left with empty shelves after cyber attack

The food shelves in the Marble Arch M&S in central London were missing some products

Some Marks & Spencer (M&S) stores have been left with empty food shelves as the retailer continues to struggle with a cyber attack affecting its operations.

Online orders have been paused on the company's website and app since Friday, following problems with contactless pay and Click & collect over the Easter weekend.

The BBC understands food availability should be back to normal by the end of the week.

Meanwhile, security experts say a cyber crime group calling itself DragonForce is behind the mayhem.

The relatively new group is expected to be asking the supermarket for a multi-million pound ransom to bring the cyber attack to an end.

The BBC has asked M&S for comment.

"Based on tracking of network activity and ransomware groups, M&S are dealing with a ransomware gang who are attempting to extort them," said security researcher Kevin Beaumont.

Like all ransomware gangs, DragonForce uses malicious software to scramble the data on as many of their victims computers as possible. They also usually steal as much confidential information as they can to use it as a bargaining chip.

• What is ransomware and how does it work?

DragonForce started attacking victims worldwide around August 2023.

It works on what is known as a "ransomware as a service" model, meaning that any cyber criminal can rent the malicious software to infect victims' systems as long as they give DragonForce a cut.

It's not known who the individual hackers responsible for the M&S hack are but some experts are pointing towards a loosely run group called Scattered Spider.

The retailer said it was working hard to get things back to normal

Noticeable shortages

It is not clear how widespread the empty shelves are but the retailer confirmed "pockets of limited availability in some stores".

The disruption in supply has come about because the firm has had to take some of its food-related systems offline. It is using different processes to improve availability, so it can operate as normally as soon as possible.

In M&S's Marble Arch store in central London, signs on some of the food shelves that were missing items said: "Please bear with us while we fix some technical issues affecting product availability."

Dot, 52, who shops at M&S regularly, said some of the shelves were quite empty.

"I was looking for my favourite biscuits and couldn't find them," she said.

Ken, 76, also said the limited stock was "definitely noticeable", although the staff were "perfectly charming" considering the cyber attack.

The firm is also managing disruption to a small proportion of products that it supplies to Ocado, which delivers M&S online orders and which is part-owned by M&S.

Although issues with contactless pay, Click & Collect and gift cards have since been resolved, customers can still not place online orders.

About a third of M&S's clothing and household goods sales in the UK are through its online platforms and were worth some £1.2bn, according to its latest financial results.

Although its share price was up slightly on Tuesday morning, it has fallen 4.6% over the last five days - with a notable dip on Friday when the firm announced it was stopping online orders.

'Like cutting off a limb'

The problems come during a busy retailing period, as customers prepare for the good weather and purchase outdoor garden equipment, barbecue items and party food.

The aftershocks of the cyber attack will dent its profits, analysts have told the BBC, as many customers go elsewhere to shop instead.

Stopping online orders was "almost like cutting off one of your limbs", said Nayna McIntosh, former executive committee member of M&S and the founder of Hope Fashion.

"It will have been a very difficult decision to have made on Friday and as it enters into its second week for them still to be there will be incredibly painful," she told the BBC.

But she added that M&S was a popular brand so customers were likely to give it some leeway as long as they have transparency.

M&S has not disclosed the nature of the cyber attack.

"As part of our proactive management of the incident, we took a decision to take some of our systems temporarily offline," a spokesperson said.

"As a result, we currently have pockets of limited availability in some stores. We are working hard to get availability back to normal across the estate."

M&S is not the only firm to suffer disruption to its online systems in recent times. Supermarket Morrisons faced problems with its Christmas order in 2024, while banks Barclays and Lloyds were hit by outages earlier in 2025.

Additional reporting by Shakira Abdi