As first reported by the Financial Times newspaper, the attack driving the insurance claim may have cost M&S more than £60 million (about $79.7 million) to date based just on the loss of its daily online sales. Although the estimate can’t account for seasonality or the true impact the incident has had on the company’s sales, assuming a 25% drop over the 24 days since Easter Sunday, M&S could have lost more than £76 million ($101 million) in gross profit. “Cyber insurance policies don’t just cover the costs of bringing in incident responders or third-party liabilities, but also the policy holder’s loss of gross profit due to an insured event,” explained Craig Dunn, the head of underwriting at insurance and cybersecurity firm Stoïk. Assuming stores are open 357 days a year — excluding the eight bank holidays in the United Kingdom — Dunn estimated daily gross profit at about £12.8 million (more than $17 million). Marks & Spencer (M&S) may reportedly file an insurance claim of up to £100 million ($133 million) as a result of last month’s cyberattack — a testament to the dramatic disruption an incident can have. If the incidents are ransomware attacks, both the British and the U.S.governments have been outspoken in their desires that the insurance industry does not fund any extortion payments, although doing so is not illegal. “What is surprising here is typically insurers will want companies of M&S’ size to have tested business continuity plans that cover events like ransomware attacks,” Dunn said. “This attack — and attacks on others in the retail sector leaving remote conurbations without access to food — and recent attacks on critical health organisations, shines a bright light on the need for government policies to robustly focus on preventative, not reactive, measures,” he said. All three attacks have been claimed by the DragonForce ransomware group, but such groups are known to make false claims and there has been no independent confirmation of the nature of the attacks.
This Cyber News was published on therecord.media. Publication date: Wed, 14 May 2025 15:45:06 +0000