M&S stores left with empty shelves after cyber attack

Some Marks & Spencer stores have been left with empty shelves as the retailer continues to struggle with a cyber attack affecting its operations.

Over the Easter weekend, customers reported problems using contactless pay and Click & Collect, and online orders have been paused on the company’s website and app since Friday.

It is not clear how widespread the empty shelves are but the retailer confirmed “pockets of limited availability in some stores”.

The BBC understands M&S’s operations will take until the end of the week before beginning to return to normal.

Although issues with contactless pay, Click & Collect and gift cards have since been resolved, customers can still not place online orders.

About a third of M&S’s clothing and household goods sales in the UK are through its online platforms and were worth some £1.2bn, according to its latest financial results.

The problems come during a busy retailing period, as customers prepare for the good weather and purchase outdoor garden equipment, barbecue items and party food.

The aftershocks of the cyber attack will dent its profits, analysts have told the BBC, as many customers go elsewhere to shop instead.

M&S has not disclosed the nature of the cyber attack.

“As part of our proactive management of the incident, we took a decision to take some of our systems temporarily offline,” a spokesperson said.

“As a result, we currently have pockets of limited availability in some stores. We are working hard to get availability back to normal across the estate. “

M&S is not the only firm to suffer disruption to its online systems in recent times. Supermarket Morrisons faced problems with its Christmas order in 2024, while banks Barclays and Lloyds were hit by outages earlier in 2025.