Marks & Spencer cyberattack – the crisis communications lessons
As the leading provider of crisis communications training for retailers, we’ve been monitoring closely the coverage of Marks & Spencer’s cyberattack. The Telegraph reports today that more than £766m has been wiped off the company’s value as it has halted online orders for a fourth day following the incident.
Other outlets are reporting that M&S is stopping staff from working from home while the company manages the impact of this cyberattack.
Crisis communications training for retailers
In our crisis communications training courses for retailers a cyberattack is one of the most common scenarios that we create working closely with the in-house communications team and their public relations advisers. We also look at incidents such as problems with supply chain, accusations of greenwashing and suggestions of sexism, racism and bullying. Other issues that we’ve created for retailers in our crisis communications workshops include social media controversies plus fires and even possible terrorist attacks. It might sound depressing and even frightening, but the fact is that retailers these days need to be prepared for these eventualities. We’re finding that more and more retailers are coming to us for advice on dealing with crises and difficult issues.
Crisis media communications courses
It’s interesting to see how the media has been covering the M&S cyberattack. On Saturday, The Times, for instance, featured a large image of Sienna Miller who has modelled for the retailer. In our crisis media communications courses, we look at how the media reports on a crisis. Every outlet will be looking for images and a celebrity looks more appealing on the page or screen than a computer or a bunch of wires, even though the latter might be more relevant. The paper points out that this latest attack on a well known name comes in the wake of other incidents, with the Post Office, Morrisons and Capita also falling victim.
We’ll also look to social media for examples of consumer reaction. This ticks the “human” box of the story. According to the Sun’s coverage, for instance. “One shopper said: “I’ve been into one of your shops this am and was so annoyed to find out you are not accepting gift vouchers at the moment. I would not have gone shopping there if I had known.”
Crisis media training
This is why we recommend in our crisis media training for retailers that they monitor social media for coverage and commentary. It doesn’t mean that you have to get into an extensive discussion with the author every of comment or conversation. It’s just that very often these days social media outlets are the first to reveal the latest events in a crisis. This monitoring also means that retailers and others can respond to fake news or false rumours.
General media training
As we explain in our crisis communications training for retailers and our general media training, journalists love a trend. Phrases such as “Comes in the wake of…” or “This is the latest example of…” work well to illustrate a trend and to make an event even more newsworthy. How does the media report on a crisis? Is a question we’re often asked and, because all of our media trainers are working journalists, they can explain how the media will put together a report on a cyberattack or any other serious incident. Contacting the regulatory bodies for comment is one element of a report. We’ll also look around for any expert who can provide insights and advice.
This shows why it’s essential for retailers and other organisations subject to a cyberattack to act quickly. M&S has done well here. The company put out a statement to the media and emailed customers. During our crisis communications training courses for retailers, we talk about the “golden hour” – or rather we used to. This was traditionally the time in which an organisation can respond to a crisis, take control and put across their message. Today, with the advent of social media, that hour is probably a matter of minutes.
Get ahead of the story
We explain in our crisis communications training for retailers that they need to have a statement ready to go. This means that as soon as they’ve confirmed a cyberattack, or any other incident, they can release a statement and get ahead of the story.
But what should a crisis statement say? What messages should it put across? Here’s how M&S’s message to customers about the cyberattack begins: “I’m writing to you to let you know that over the last few days M&S has been managing a cyber incident. To protect you and the business, it was necessary to temporarily make some small changes to our store operations, and I am sincerely sorry if you experienced any inconvenience.”
Marks & Spencer cyberattack – the crisis communications lessons
The message comes from the CEO. This feels right, given the severity of the incident. Choosing the most appropriate spokesperson during a crisis is essential. Should it be the CEO or the Chief People Officer? Would the head of security or cyber be better placed to comment? Again, it’s something that an organisation needs to have already planned. In one of our recent crisis communications training workshops, we had a discussion with the participants about whether they should field a male or female board member.
The wording in M&S’s statement is clear, simple and natural. It’s also active – “M&S has been managing a cyber incident.” “We’re suffering…” or “We’ve been made aware…” would sound too passive, as if the organisation is not in control or is simply reacting to events. Making it clear that you’re taking action is extremely important. We also like “To protect you…” as it shows care and concern for the audience, and this is something that we strongly recommend during our crisis communications training for retailers.
Shouldn’t they have been doing this anyway
The reference to “the business” is not so relevant, though. We’re big fans of M&S here at Communicate Media but to be completely blunt about it, as consumers we’re more concerned about the safely of our personal details and the likelihood of that new T-shirt or dress that we’ve ordered actually reaching us. It’s the same when organisations praise their staff in an external communication. If you want to tell us that you’re highly trained teams have responded quickly to protect us and ensure minimum disruption to the service, then that’s fine. But the danger with just praising your staff is that your customers, suppliers and others might take the view that you’re being rather smug. “Shouldn’t they be doing this anyway,” could very easily be the reaction. It’s an interesting conversation that we have with participants in our crisis communications workshops for retailers.
Reassurance is important
Reassurance is another important message in a crisis and it’s one that we emphasise to the retailers that we work with on crisis communications. “Importantly, our stores remain open, and our website and App are operating as normal,” M&S tells us. “There is no need for you to take any action at this time and if the situation changes, we will let you know. There may be some limited delays to your Click and Collect order, which we are working hard to resolve.”
This is good – not only does it reassure our audience, but it informs them clearly and simply what they have to do or, not do. Again, there’s a good example here of the company taking action. It’s worth adding that getting the tone right with reassurance is important. You don’t want to dismiss or minimise the incident. We give the example of the clinical director of one large pharmaceutical company who, when asked about possible deaths of people using one of the company’s drugs told journalists: “Look, we sell millions of these products every year. This is only four or five deaths out of that total.”
OK, that’s all right then.
Adding care and concern plus action to your reassurance is important. Testing the wording of any crisis statement to ensure that not only is it factually correct but the tone and language are sympathetic and human but also demonstrate strength and purpose is essential.
Marks & Spencer cyber attack of 2025
Marks & Spencer has generally done well in the way in which it has communicated during this cyberattack, we would say. During our crisis communications training for retailers, we look at real life examples to identify lessons and tips for better crisis communications management. After all, with the development of social media and a growing range of threats to retailers, this is a rapidly evolving discipline.
The M&S cyberattack of 2025 will certainly be added to our list of case studies. Come and talk to us about our crisis communications training for retailers. We would be delighted to work with you.
Crisis communication training
Come and talk to us about our crisis communication workshops. You can follow us on LinkedIn here.
