M&S hackers may have gained access via IT partner TCS

A major cyber breach at UK retailer Marks & Spencer has thrust its IT services provider into the spotlight. Tata Consultancy Services is currently conducting an internal investigation, to determine if it could have been the gateway hackers used to access its client’s systems.

In recent weeks, the UK’s retail sector has been rattled by high-profile cyber hacks. Marks & Spencer has been perhaps the most impactful. M&S chief executive, Stuart Machin, said it will take an estimated £300 million hit to profits this year from the damaging cyber-attack that it expects to disrupt its online business into July.

The Metropolitan Police's cyber-crime unit and the National Crime Agency (NCA) are investigating the M&S attack. But they will not be the only ones.

M&S said the hackers who had accessed its systems via a “third party” – a company working alongside it – rather than via a direct attack. According to reports from the BBC, Tata Consultancy Services (TCS) is therefore conducting its own internal investigation, to determine whether it was the gateway for the cyber-attack on M&S.

TCS has provided services to M&S for more than a decade. In 2023, it said in a press release that TCS and M&S were “recognised for their collaboration to build an in-house loyalty platform using the latest technology stack, an engineering-driven approach, and a cloud-first strategy to enhance customer experience”. The collaboration was a driving factor in TCS’ Retail Partnership of the Year award win that year.

While it is not clear when TCS launched its investigation – and the firm declined to comment when approached by the BBC – The Financial Times has also reported people close to the investigation expect the inquiry to conclude by the start of June.

In February 2024, TCS also announced a new partnership with British retail cooperative The Co-op, working to revamp its IT infrastructure and adopt a cloud first strategy.

Avoiding the next headline

Following a wave of high-profile cyber-attacks on major UK retailers including Co-op and Harrods, and M&S, cyber security expert Katherine Kearns from S-RM recently urged companies to tighten supply chain security to avoid becoming the next headline. According to Kearns, firms should identify critical vendors as a first step. 

She explained, “Begin by understanding the organisation’s third-party exposure and the impact this can have on the business. It is particularly important to identify and inventory third-party suppliers that have access to sensitive data, have access into your internal environment, provide critical software, and could significantly affect business continuity if disrupted.”