M&S says April cyberattack caused by 'sophisticated impersonation' of third-party

The company's Irish online store remains closed for orders

Marks & Spencer Group Plc has estimated the cyberattack will deal a £300m (€347.2m) blow to operating profit. File photo

The cyberattack that derailed Marks and Spencer Group Plc’s operations for weeks was the result of a “sophisticated impersonation” of one of the retailer’s third-party users, according to Chairman Archie Norman.

The hackers entered M&S’s systems on April 17 and the company detected them two days later, Norman told members of the UK Parliament’s business and trade committee on Tuesday. That triggered a “traumatic” period, with the cyber team getting barely any sleep as they grappled with the fallout, he said.