Business reporter, BBC News
BBCSome Marks & Spencer stores have been left with empty food shelves as the retailer continues to struggle with a cyber attack affecting its operations.
Online orders have been paused on the company’s website and app since Friday, following problems with contactless pay and Click & collect over the Easter weekend.
It is not clear how widespread the empty shelves are but the retailer confirmed “pockets of limited availability in some stores”.
The BBC understands food availability should be back to normal by the end of the week.
In M&S’s Marble Arch store in central London, signs on some of the food shelves that were missing items said: “Please bear with us while we fix some technical issues affecting product availability.”
Dot, 52, who shops at M&S regularly, said some of the shelves were quite empty.
“I was looking for my favourite biscuits and couldn’t find them,” she said.
Ken, 76, also said the limited stock was “definitely noticeable”, although the staff were “perfectly charming” considering the cyber attack.
The firm is also managing disruption to a small proportion of products that it supplies to Ocado, which delivers M&S online orders and which is part-owned by M&S.
Although issues with contactless pay, Click & Collect and gift cards have since been resolved, customers can still not place online orders.
About a third of M&S’s clothing and household goods sales in the UK are through its online platforms and were worth some £1.2bn, according to its latest financial results.
Although its share price was up slightly on Tuesday morning, it has fallen 4.6% over the last five days – with a notable dip on Friday when the firm announced it was stopping online orders.
The problems come during a busy retailing period, as customers prepare for the good weather and purchase outdoor garden equipment, barbecue items and party food.
The aftershocks of the cyber attack will dent its profits, analysts have told the BBC, as many customers go elsewhere to shop instead.
Stopping online orders was “almost like cutting off one of your limbs”, said Nayna McIntosh, former executive committee member of M&S and the founder of Hope Fashion.
“It will have been a very difficult decision to have made on Friday and as it enters into its second week for them still to be there will be incredibly painful,” she told the BBC.
But she added that M&S was a popular brand so customers were likely to give it some leeway as long as they have transparency.
M&S has not disclosed the nature of the cyber attack.
“As part of our proactive management of the incident, we took a decision to take some of our systems temporarily offline,” a spokesperson said.
“As a result, we currently have pockets of limited availability in some stores. We are working hard to get availability back to normal across the estate.”
M&S is not the only firm to suffer disruption to its online systems in recent times. Supermarket Morrisons faced problems with its Christmas order in 2024, while banks Barclays and Lloyds were hit by outages earlier in 2025.
Additional reporting by Shakira Abdi