M&S has been dealing with a major cyber attack for almost two weeks now, leaving customers unable to order online and facing empty shelves.
The posh supermarket initially saw its contactless payments go down and disruption to click and collect orders following the attack on Monday, April 21.
It was later forced to suspend all online orders through its app and website last week, causing further chaos.
The supermarket said at the time this was part of its "proactive management" of the cyber attack and that it was "truly sorry" for the disruption.
Shoppers have also noticed empty shelves and shortages of popular items such as bananas, fish, and the iconic Colin the Caterpillar cakes.
Despite M&S teams working hard to get its systems back, the issue is still ongoing.
Read more on M&S
Here is everything you need to know...
When will shelves be restocked?
Some M&S shoppers have seen "completely empty" shelves in the supermarket's food halls in recent days.
Missing items included bananas, fish, and even the Colin the Caterpillar cakes that M&S is famous for.
reported signs had appeared on the hot food counters of one store stating they were "temporarily closed".
Most read in Money
The notice read: "Due to technical issues, we aren’t able to offer these products at the moment."
When questioned, staff suggested the supply disruptions were connected to a cyber attack.
An M&S spokesperson said the supermarket had taken some of its systems temporarily offline following the attack and therefore had "pockets of limited availability in some stores".
The Sun understands that availability is expected to improve over the coming days.
When will online orders come back?
M&S has not confirmed when its online orders will be back.
They were first suspended last Friday, but the supermarket told The Sun it has "no update to share" on this.
It said it couldn't give an idea of when online orders would be back.
It's understood that customers can still shop the M&S range through the Ocado website as normal.
You can also still shop as normal in M&S stores.
What happened and what else has been impacted?
The issues began when customers reported payment problems and delays receiving online orders.
M&S first revealed it had been dealing with a "cyber incident" on Monday, April 21.
In an email to shoppers, M&S chief executive Stuart Machin wrote: "Over the last few days, M&S has been managing a cyber incident. To protect you and the business, it was necessary to temporarily make some small changes to our store operations, and I am sincerely sorry if you experienced any inconvenience.
"Importantly, our stores remain open, and our website and app are operating as normal. There is no need for you to take any action at this time, and if the situation changes, we will let you know."
It soon emerged customers were also having problems with contactless payments and click-and-collect services at stores across the UK.
Later, M&S also had to ask about 200 agency workers at its main distribution centre to stay home due to a slowdown in order processing.
Contactless payments are now back up and running.
Timeline of cyber attack
- Saturday, April 19: Initial reports emerge on social media of problems with contactless payments and click-and-collect services at M&S stores across the UK. Customers experience difficulties collecting online purchases and returning items due to system issues.
- Monday, April 21: Problems with contactless payments and click-and-collect persist. M&S officially acknowledges the "cyber incident" in a statement to the London Stock Exchange. CEO Stuart Machin apologises for the disruption and confirms "minor, temporary changes" to store operations. M&S notifies the National Cyber Security Centre (NCSC) and the Information Commissioner's Office (ICO) and engages external cybersecurity experts.
- Tuesday, April 22: Disruptions continue. M&S takes further systems offline as part of "proactive management".
- Wednesday, April 23: Despite earlier claims of customer-facing systems returning to normal, M&S continues to adjust operations to maintain security. Contactless payments are initially restored, but other services, including click-and-collect, remain affected.
- Thursday, April 24: Contactless payments and click-and-collect services are still unavailable. Reports surface suggesting the attackers possibly gained access to data in February.
- Friday, April 25: M&S suspends all online and app orders in the UK and Ireland for clothing and food, although customers can still browse products. This decision leads to a 5% drop in M&S's share price.
- Monday, April 28: M&S is still unable to process online orders. Around 200 agency workers at the main distribution centre are told to stay home.
- Tuesday, April 29: Information suggests that the hacker group Scattered Spider is likely behind the attack. Shoppers spot empty shelves in selected stores.
Can you get compensation?
Some customers have also been affected by orders being cancelled, with some waiting for refunds.
But can shoppers get compensation?
The Sun previously asked M&S after one shopper claimed to have been offered a £25 gift card over a cancelled order.
Complaints to the supermarket are being considered on a case by case basis, with no set amount being handed out - and no guarantee of cash.
However, some customers are being given gift cards as part of its normal complaints process.
A spokesperson said: "Our Customer Service team always support customers to make sure they're getting the best experience when shopping at M&S and we always do that on an individual basis."
If you've been affected, you can try complaining to the retailer.
It's pretty common for retailers to give out gift cards or discount codes on a case-by-case basis if a customer complains.
You can complain to M&S either by phone or through social media.
Who was behind the cyber attack?
Insiders have said an infamous criminal gang known as "Scattered Spider" is to blame.
Some staff have alleged M&S systems were "held to ransom by a criminal gang".
Scattered Spider is one of the most prolific cyber gangs of the past 18 months.
It specialises in ransomware, a type of attack designed to steal information or access in exchange for a sum of money.
The criminal gang is known for its ability to "manipulate access, often by impersonating employees or exploiting multi-factor authentication systems", Jamie Akhtar, CEO and co-founder at CyberSmart, told The Sun.
M&S has not disclosed the exact nature of the breach.
However it has been revealed it reported the incident to the National Cyber Security Centre (NCSC) and the Information Commissioner's Office (ICO).
The National Crime Agency has also said it has been involved.
Another hacking attempt?
A second major supermarket has said it was the victim of a hacking attempt earlier this week.
The Co-op, which operates over 2,000 grocery stores and 800 funeral homes, said it had closed part of its IT system as a result.
In a letter to staff on Tuesday, it said it had "taken proactive steps to keep our systems safe".
This included restricting access to certain systems, impacting some back-office functions and call centre services.
One source said the shutdown resulted in the closure of virtual desktops across the organisation, disrupting several behind-the-scenes operations reliant on head office support, such as stock updates.
However it said there is no indication customer data has been compromised and that stores, home deliveries and funeral homes are all open and operating as usual.
M&S forced to pause hiring
Another impact of the cyber attack is that M&S has pulled all job adverts from its website and halted recruitment, according to the .
M&S told the outlet: "While we proactively manage the cyber incident, we are temporarily pausing some of our normal processes so we can continue to work hard on offering the best M&S for our customers and colleagues.
Read More on The Sun
"Job adverts will be up again in due course."
The Telegraph reported that last week the same site had 232 vacancies listed.