M&S confirms insurance recoveries expected after ransomware attack

By Scott Vincent

May 21 - (The Insurer) - UK retailer Marks & Spencer has confirmed it expects to make insurance recoveries related to its recent ransomware attack, which is set to cost the group 300 million pounds ($402.6 million).

In a results filing on Wednesday, M&S said it expected insurance recoveries to reduce its total bill from the attack, but did not disclose by how much.

As previously reported by The Insurer, M&S has a cyber policy in place providing up to 100 million pounds of cover, brokered by WTW. One senior market source told The Insurer the attack is likely to result in a full tower loss.

M&S disclosed the cyber incident on April 22, with the knock-on effects leading the UK retailer to cancel online orders and suspend recruitment as employees were ordered to work on personal devices.

A further statement from the retailer on May 13 disclosed that some personal customer data had been compromised, including contact details, dates of birth and online order histories.

It added that there was no evidence that the data had been shared, or that data relating to payment details or account passwords had been accessed.