Can Marks & Spencer's reputation recover long-term after major cyber attack?

The cyber attack on Marks & Spencer in April sent shockwaves through the industry and it is estimated to impact the retailer’s profits this year by around £300 million.

At the beginning of July, M&S CEO Stuart Machin said the British department store hoped to have the majority of the impact "behind us" by August, and last week M&S announced its Sparks loyalty scheme is now fully back online, featuring a range of ‘thank you’ treats and rewards for "extraordinary support and loyalty" from customers.

However, new research from The Harris Poll UK, which surveyed 1,000 nationally representative UK consumers in June, reveals that the percentage of consumers who would recommend M&S has dropped by 21% compared to the start of the year, while 33% of M&S shoppers now intend to shop elsewhere.

While there is usually good will and loyalty from UK customers for M&S, it could mean that the initial damage caused by the cyber incident could cause longer term reputational damage.

Customer trust was certainly deeply scarred by the incident, especially since personal data had been stolen. While the data did not include payment/card details or passwords, and was not believed to have been shared online, it could have included names, email addresses, postal addresses and dates of birth.

In relation to ‘customer forgiveness’, the new research says the percentage of people who would forgive M&S has dropped from 84% in January to 72% now. Not quite as devastating as it could have been, and perhaps an indication that customer loyalty is still one of Marks & Spencer's great strengths.

Indeed, while most corporate reputation drivers tracked in the study have declined, M&S continues to perform relatively well in perceptions of product and service quality.

Stephen Brockway, Chief Research Officer at The Harris Poll UK, said: "The data tells a clear story - the cyber incident and its aftermath have fundamentally shaken confidence in M&S’s direction and crisis readiness.

"However, this is not a reputational collapse. There’s still a strong core of consumer trust, especially in the quality of what M&S offers. The brand has meaningful ‘reputational credit’ in the bank, however that credit is being spent thanks to this cyber incident.

"If M&S moves quickly to rebuild authority and communicate a clear future path, it can recover from this."

Retail analyst Richard Hyman added: "M&S has clearly lost sales that cannot be recovered, and some customers will have gone elsewhere while the website was down. However, the turnaround was strong before the hack - M&S had won back many previously lost customers and gained some new ones.

"I think the communication from its leadership team was very open and clear. The website has not yet fully returned to full operational status. I believe there has certainly been damage, but I don’t think it’s permanent."