M&S boss Stuart Machin has every reason to hate the shadowy cyber-criminals who attacked the store he runs. He has been working night and day to try to put it right, it has threatened his successful recovery drive and will cost him £1 million in pay.
Surely he would like to see draconian punishment for the culprits?
But Machin refuses to be drawn on what he’d like to say to the hackers, reported to be a gang including teenagers, and what their punishment should be. He says: ‘I’m not focused on the hackers. I detached myself from that very quickly.’
Because he was so angry?
‘Because I wanted to put my energy into our customers, our colleagues, into getting the business on track,’ he says.
In his first interview since the attackers struck, he defied the hackers and vowed: ‘We intend to come back better and stronger than ever.’
Focused: Stuart Machin refuses to be drawn on what he’d like to say to the hackers and what their punishment should be
Machin learned late at night that the store’s systems had been hacked, and his reaction was visceral. He says: ‘I went into shock. It’s in the pit of your stomach, the anxiety. But you have to think: ‘Stuart, you have to lead this, you have to keep a cool head.’ I don’t know if I was calm. It was a mixture of emotions because I care, I put my life into transforming M&S.’
Having emerged from the shock, he says: ‘By day three I was going everywhere and talking to everyone. I spoke to every store manager.’
Cyber incidents are all too common these days but in M&S, the hackers had targeted a national icon. There was even speculation early on that Marks was singled out by a hostile power due to its unique place in British hearts.
However, when I use the word crisis, the 54-year-old bridles. He says: ‘I wouldn’t call it a crisis – that is too dramatic.’
What would he call it?
‘An incident, a setback, a bump in the road, a disruption,’ he says.
‘I’m not underestimating it, I have a responsibility to be truthful, to put things in perspective and be pragmatic.’
Whatever the vocabulary, there is no doubt this is a serious situation. Shoppers, staff and shareholders have been unnerved by the hack, by shadowy cyber-criminals who apparently gained entry to M&S systems via a third party.
The personal data of millions of customers was stolen though Machin insists the hackers have not done anything with it and there is constant monitoring in place.
M&S revealed last week the costs will be up to £300 million and the disruption could go on until July. Machin says, with some understatement, that it is ‘frustrating, because we just had the best year in 17 years’.
Shares in the retailer had, until the attack, been recovering well but around £1 billion has been wiped off its market value.
Having taken over as chief executive in 2022, he had, until the cyber chaos, earned plaudits for transforming the retailer.
The much loved chain had lost its way and none of his predecessors had quite managed to put it definitively back on course.
Machin lives and breathes M&S. A workaholic and self-confessed perfectionist control freak, he wakes at the crack of dawn and spends much of his weekends checking out stores. He has been so focused on sorting out the hack that he has been too busy for a long chat with his beloved mum, who he says is his inspiration.
‘I haven’t really spoken to her,’ he says. ‘I gave her one quick call last week and that was it. I’ve just not had time. It is not true we had sleeping bags here, but the first week, it was full on 24 hours a day.’
Rather than succumb to despair, he vows M&S will emerge stronger. He says: ‘I feel motivated by this and the store managers do too. I had a text from a regional director saying a smooth sea never made a skilled sailor. We’ve been around for 140 years with lots of challenges. We survived that and we’ll survive this.’
He has been buoyed by support from customers, including his good friend Dame Joan Collins.
Famous friends: M&S boss Stuart Machin dines with actress Joan Collins and actor Christopher Biggins
The 92-year-old posted a video on Instagram of herself taking time out of shooting a movie to buy snacks in Marks & Spencer.
The star was looking glamorous in oversized sunglasses, a quilted leather jacket and a baseball cap.
‘Joan went in shopping straight away and did some social media. She sent me a message wishing me all the best,’ Machin says. He also found light relief in a post on social media from a customer telling the hackers they had upset her cat because its M&S treats were temporarily unavailable.
The post went viral with demands to call in the FBI: the Feline Bureau of Investigations. ‘We’ve sent the customer a bag of cat treats now,’ says Machin, who has been deluged with thousands of letters, emails and social media posts from customers, 80 per cent supportive, he says.
Even City analysts have been charitable. Experts at Shore Capital, the retailer’s ‘house’ broker, said the response to the hack ‘has shown M&S leadership and culture at its best’. Rival brokers at Peel Hunt weighed in to say: ‘We love what management has done and it is with a heavy heart that we downgrade the shares to ‘hold’.’
The broker had previously rated M&S as a ‘buy’.
Machin’s aim is to wrest triumph from disaster. He hopes to exploit the time to push through improvements to the online merchandise planning platform. He says: ‘It was a three-year plan. Probably it will be a year and a half now.’
He is buoyed by the fact M&S was in its best financial shape for 30 years before the hackers struck, so is in a strong position to weather the storm. Its balance sheet was ‘very strong’ after net debt had been reduced by £900 million over three years.
When quizzed on why it is taking so long to restore online fashion shopping, his answer is that it is not. He says: ‘It may take five or six weeks, but, to put that in context, we are on a five-year transformation plan. One thing I know about leadership is this. I am very demanding but if you are just demanding about the speed of the outcome, you have people taking shortcuts. So I’d like to get it right.’
He says ‘quite a few’ chief executives rang him to commiserate, having been through similar experiences. He says: ‘It can happen to anyone. They all advised me to watch for burnout, and that it is likely to take longer than you think to put right. Everyone is way too obsessed with it taking too long. It is quite unfair. I have always – when I have given updates – been brutally honest. I have managed expectations because I don’t like going out with false hope.’
Have lessons been learnt?
‘I don’t know if the term is lessons but I have learned everyone is vulnerable. The hackers only need to be lucky once,’ Machin says.
The episode raised questions as to the state of M&S’s preparedness, its defences and back-up plans.
The retailer was investing heavily in cyber security ahead of the attack, Machin says, adding: ‘We did a simulation exercise last year. Because of that, I knew who to call. I had people on speed dial in case it happened.’
The cyber-security team has been increased four-fold in three years, he says, and the ‘tech spend is three times what it was five years ago’. He adds: ‘We told the authorities immediately. We had a plan in place in case this happened.’
Is there enough technological expertise among directors and senior managers to make sure the company is protected against further attacks? Does the board need to be stronger in that respect?
‘I would make it a broader point of beefing up our experience of tech and this is something we have done,’ Machine says. ‘Go back two years, and I was really clear I wanted a bigger leader on tech, which is why we recruited Rachel Higham as our chief digital and technology officer.’
Higham, who was previously at advertising giant WPP, joined just over a year ago. Machin says: ‘She has gone through this before though and she is very resilient.’
He seems put out by suggestions that the company may face an investigation by the Information Commissioner’s Office for its handling of the affair, saying: ‘I don’t know if regulators will be investigating but I hope not and I would be disappointed.
‘We have worked very hard to do the right thing and keep everyone up to date and informed.’
He has, he says, already drawn a line under the affair. He says: ‘We are chins up, shoulders back, dust ourselves down.
‘I want to look forward.’
DIY INVESTING PLATFORMS
AJ Bell
AJ Bell
Easy investing and ready-made portfolios
Hargreaves Lansdown
Hargreaves Lansdown
Free fund dealing and investment ideas
interactive investor
interactive investor
Flat-fee investing from £4.99 per month
InvestEngine
InvestEngine
Account and trading fee-free ETF investing
Trading 212
Trading 212
Free share dealing and no account fee
Affiliate links: If you take out a product This is Money may earn a commission. These deals are chosen by our editorial team, as we think they are worth highlighting. This does not affect our editorial independence.
