The chairman of Marks & Spencer has told MPs the company is “still in the rebuild mode” following a cyber attack which led to empty shelves and limited online operations for months.
Speaking publicly for the first time since the attack, Archie Norman declined to answer whether the business had paid a ransom.
“It’s a business decision, it’s a principal decision,” he told members of the Business and Trade Committee.
“The question you have to ask is – and I think all businesses should ask – is, when they look at the demand, what are they getting for it?
“Because once your systems are compromised and you’re going to have to rebuild anyway, maybe they’ve got exfiltrated data that you don’t want to publish. Maybe there’s something there, but in our case, substantially the damage had been done.”
Money blog: 10 happiest and unhappiest professions for shift workers
What happened?
The initial entry into M&S’s systems took place on 17 April through “sophisticated impersonation” that involved a third party, Mr Norman said.
It was two days later before the company became aware of the attack, and approximately a week after the intrusion before the retailer heard directly from the attacker.
“Anybody who’s suffered an event like ours, it would be foolish to say there’s not a thousand things you’d like to have done differently,” he added.
In a warning to other businesses, M&S’s general counsel and company secretary Nick Folland said firms should be prepared to operate without IT systems.
“One of the things that we would say to others is make sure you can run your business on pen and paper,” he said.
Be the first to get Breaking News
Install the Sky News app for free
This breaking news story is being updated and more details will be published shortly.
Please refresh the page for the fullest version.
You can receive breaking news alerts on a smartphone or tablet via the Sky News app. You can also follow us on WhatsApp and subscribe to our YouTube channel to keep up with the latest news.
