An Indian IT firm is conducting an internal review to assess whether it may have served as the entry point for the recent cyber-attack on Marks & Spencer, according to information obtained by BBC News.
Tata Consultancy Services (TCS), which has been a technology partner to M&S for over ten years, is believed to be examining any potential vulnerabilities linked to its systems.
Earlier this week, M&S revealed that the attackers had infiltrated their systems through a “third party” contractor, rather than breaching the retailer’s infrastructure directly.
Neither M&S nor TCS has issued a public statement regarding the investigation. The Financial Times, which first broke the story, cited sources familiar with the situation who indicated that the inquiry could be completed by the end of the month. However, it remains unclear when TCS initiated the probe.
Since late April, customers have been unable to make purchases through the M&S website. The company has said online services are expected to be gradually restored in the coming weeks, though disruptions may persist into July.
M&S estimates the financial impact of the cyber-attack could reduce its profits this year by approximately £300 million.
Law enforcement efforts are currently focused on Scattered Spider, a well-known group of English-speaking cybercriminals suspected of orchestrating several high-profile attacks, including those on Harrods and the Co-op. However, M&S appears to have been the hardest hit.
TCS, which employs over 607,000 people globally, is a major sponsor of international marathons in New York, London, and Sydney. On its website, TCS highlights its collaboration with M&S on the Sparks loyalty programme, and in 2023, the two companies were jointly awarded Retail Partnership of the Year at the Retail Systems Awards.
TCS’s client base includes major brands such as the Co-op, easyJet, Nationwide, and Jaguar Land Rover. It is unknown whether the company’s internal investigation also covers the Co-op cyber incident.
Earlier this week, M&S CEO Stuart Machin acknowledged that the company had been dealing with a “highly sophisticated and targeted cyber-attack,” which caused temporary service disruption. During a media briefing on Wednesday, he declined to answer whether a ransom had been paid in response to the breach.
Click here for more news on Technology
