The chairman of Marks & Spencer has told MPs the company is “still in the rebuild mode” and will be for “some time to come” following a cyber attack which led to empty shelves and limited online operations for months.
Speaking publicly for the first time since the attack, Archie Norman declined to answer whether the business had paid a ransom.
“It’s a business decision, it’s a principal decision,” he told members of the Business and Trade Committee (BTC).
“The question you have to ask is – and I think all businesses should ask – is, when they look at the demand, what are they getting for it?
“Because once your systems are compromised and you’re going to have to rebuild anyway, maybe they’ve got exfiltrated data that you don’t want to publish. Maybe there’s something there, but in our case, substantially the damage had been done.”
When asked again later in the BTC evidence session, Mr Norman said, “We’re not discussing any of the details of our interaction with the threat actor, including this subject, but that subject is fully shared with the NCA [National Crime Agency].”
“We don’t think it’s in the public interest to go into that subject on it, because it is a matter of law enforcement”, he added.
What happened?
The initial entry into M&S’s systems took place on 17 April through “sophisticated impersonation” that involved a third party, Mr Norman said.
It was two days later, on Easter Saturday, before the company became aware of the attack, and approximately a week after the intrusion, before the retailer heard directly from the attacker.
Please use Chrome browser for a more accessible video player
1:21
Who is behind M&S cyberattack?
A day later, after learning of the attack, the authorities were notified, while customers were told on Tuesday, MPs heard.
As well as British authorities, the US FBI was contacted, who are “more muscled up in this zone” and were “very supportive”, Mr Norman said.
By the time the breach is clear, systems have already been compromised, the chairman said.
The group behind the attack may have been Scattered Spider, some of whom are believed to be English-speaking teenagers, but Mr Norman said M&S made an early decision that no one from the company would deal directly with the so-called “threat actor”.
“Anybody who’s suffered an event like ours, it would be foolish to say there’s not a thousand things you’d like to have done differently,” he added.
Advice for businesses
In a warning to other businesses, M&S’s general counsel and company secretary Nick Folland said firms should be prepared to operate without IT systems.
“One of the things that we would say to others is make sure you can run your business on pen and paper,” he said.
Awareness and planning for the threats of cybersecurity meant M&S had trebled the number of people working on cybersecurity to 80and doubled its expenditure.
“We curiously doubled our insurance cover last year”, Mr Norman added.
In a good position
The business was better positioned to deal with the strike than at the start of Mr Norman’s tenure, he said.
“The context of M&S is when I joined the business, it was a very broken business… our systems were in a pretty decrepit state.”
“So I have to say if this has happened then I think we would have been kippered.”
Recent profits meant the company was “muscled up”.
“Extensive” insurance cover means M&S expects to make an “unsurprisingly significant claim” and receive “substantial recovery”, though the process of finding out how much will take about 18 months.
The £300m sum M&S said it expected to lose as a result of the cyber attack does not include money it expects to claim via insurance. The financial hit was calculated at £300m as the chain department store was losing £10m a week by not operating online.
The incident has “not really” affected its future, Mr Norman said.
The security services expressed concern about the appointment of Lord Mandelson as ambassador to Washington, but No 10 went ahead anyway, Sky News understands.
Downing Street today defended the extensive vetting process which senior civil servants go through in order to get jobs, raising questions about whether or not they missed something or No 10 ignored their advice.
Sky News has been told by two sources that the security services did flag concerns as part of the process.
No 10 did not judge these concerns as enough to stop the ambassadorial appointment.
It is not known whether all of the detail was shared with Prime Minister Sir Keir Starmer personally.
Sky News has been told some members of the security services are unhappy with what has taken place in Downing Street.
More on Keir Starmer
Related Topics:
Lord Mandelson is close to Sir Keir’s chief of staff, Morgan McSweeney, who is known to have been keen on the appointment – and the pair spoke regularly.
No 10 says the security vetting process is all done at a departmental level with no No 10 involvement.
Shadow foreign secretary Priti Patel described the revelations as “extraordinary”.
“For Keir Starmer, and his Chief of Staff Morgan McSweeney, to have appointed Lord Mandelson despite concerns being raised by the security services shows a blatant disregard of all national security considerations and their determination to promote their Labour Party friends,” she said in a statement.
“Starmer leads a crisis riddled government consumed by a chaos of his own making, because he puts his Party before the needs of our country.
“The country deserves the honest truth this spineless prime minister refuses to give them.”
Image: Priti Patel described the revelations as ‘extraordinary’.
The prime minister, who selected Lord Mandelson for the role, made the decision after new emails revealed the Labour peer sent messages of support to Epstein even as he faced jail for sex offences in 2008.
In one particular message, Lord Mandelson had suggested that Epstein’s first conviction was wrongful and should be challenged.
The Foreign Office said the emails showed “the depth and extent of Peter Mandelson’s relationship with Jeffrey Epstein is materially different from that known at the time of his appointment”.
The decision to sack the diplomat was made by the prime minister and Foreign Secretary Yvette Cooper on Thursday morning, Sky News understands.
This was after Sir Keir had reviewed all the new available information last night.
Please use Chrome browser for a more accessible video player
2:59
Harriet Harman, Ruth Davidson, and Beth Rigby react to the news of Lord Mandelson’s sacking.
It comes after a string of allegations around the diplomat’s relationship with Epstein, which emerged in the media this week, including a 2003 birthday message in which he called the sex offender his “best pal”.
Further allegations were then published in The Telegraph on Wednesday morning, suggesting that Lord Mandelson had emailed Epstein to set up business meetings following the latter’s conviction for child sex offences in 2008.
Additional emails were then published detailing how the diplomat wrote to Epstein the day before he went to prison in June 2008 to serve time for soliciting sex from a minor. Lord Mandelson said: “I think the world of you.”
Peter Mandelson, the UK ambassador to the US, has been sacked from his role as scrutiny builds over his relationship with disgraced financier Jeffrey Epstein.
The diplomat’s most famous quotation sums up his attraction to the rich and famous and his fondness for the trappings of wealth.
“We are intensely relaxed about people getting filthy rich,” he told tech executives when he was Sir Tony Blair’s trade and industry secretary in 1998.
“As long as they pay their taxes,” he added hurriedly, the former spin doctor known as the “Prince of Darkness” acutely aware of the risk of damaging headlines.
Now, less than nine months after his controversial appointment by Sir Keir Starmer as UK ambassador, his association with convicted sex offender Epstein suggests once again that he appears unable to avoid scandal.
Aged 71, Lord Mandelson – awarded a peerage by Gordon Brown in 2008 – had to resign from Sir Tony’s cabinet twice, first over an undeclared bank loan and then over intervening in a passport application by a top Indian businessman.
More on Peter Mandelson
Related Topics:
Over four decades, nearly all on the front line of British politics, he has been a consummate political networker, but he has also been one of the most divisive figures in public life and his appointment last December was seen by critics as an act of cronyism by Sir Keir.
Acknowledging that Lord Mandelson was a controversial and divisive figure, Sir Tony declared in 1996: “My project will be complete when the Labour Party learns to love Peter Mandelson.”
The Washington role is seen as the most glittering and important diplomatic post in the UK government. The perks of the job include the luxurious ambassador’s residence in Massachusetts Avenue, a magnificent Queen Anne mansion designed by top architect Sir Edwin Lutyens.
When he appointed him as ambassador, Sir Keir saw Lord Mandelson as a skilful and persuasive link to the president, with his trade experience from his time as a cabinet minister and Brussels commissioner a vital qualification for the job.
Never one for false modesty, Lord Mandelson claims that when he first walked into the Oval Office the president said to him: “God, you’re a good-looking fellow, aren’t you?”
Lord Mandelson can be credited with several diplomatic triumphs in Washington. He played a vital role in ensuring the UK escaped the worst of Trump’s tariffs and he was instrumental in securing a much sought-after trade deal between the UK and the US.
And his silky PR skills were displayed when during Sir Keir’s first visit to the White House in February the PM theatrically pulled out of his inside pocket a letter from King Charles inviting the present to visit the UK.
It was a classic Lord Mandelson stunt and confirmed he’d lost none of the flair for presentation he’d first deployed when he was Labour leader Neil Kinnock’s spin doctor in the 1980s.
Lord Mandelson’s high-profile political career began as a TV producer until his appointment as Labour’s director of communications under Neil Kinnock in 1985.
He was seen as a brilliant if ruthless spin doctor, who masterminded the birth of New Labour but would berate newspaper editors when unfavourable stories were written by their political journalists.
Another classic Lord Mandelson attempt to kill an embarrassing story was to tell the journalist who wrote or broadcast it in a sneering voice: “That is a story that I believe will remain an exclusive.”
He became MP for Hartlepool in 1992 and helped propel Sir Tony to the leadership of the party after John Smith’s death in 1994, a move that led to a bitter feud with Mr Brown.
There’s an amusing story about Mandelson in Hartlepool, which he claims is a myth and blames Mr Kinnock for. It’s claimed he ordered “some of that delicious guacamole” in a fish and chip shop, mistaking mushy peas for avocado dip.
It was a perfect Lord Mandelson story, ridiculing his metropolitan tastes and ignorance of working-class life. But he claims the mistake was made by a young American woman student who was helping Labour’s campaign.
Image: Tony Blair and Lord Mandelson in 2000. Pic: Paul Faith/PA
His first cabinet job, trade and industry secretary in 1998, lasted only five months after he was forced to quit after failing to declare a home loan from Labour millionaire Geoffrey Robinson to his building society.
His resignation was similar in one respect to the demise of former deputy prime minister Angela Rayner last week, in that it was over irregularities in buying a property: in Hove in her case, in fashionable Notting Hill in his.
He bounced back as Northern Ireland secretary in 1999 and was said to enjoy the luxury of Hillsborough Castle, which went with the job. But he was forced to resign a second time over claims he helped businessman Srichand Hinduja with an application for UK citizenship.
When he held his seat in Hartlepool in the 2001 general election, Mandelson made a passionate and defiant victory speech at his count in which he declared: “I’m a fighter, not a quitter.”
Yet three years later he did quit as an MP, when he became a trade commissioner in Brussels, serving a four-year term during which he had a spectacular row with French president Nicolas Sarkozy, who accused him of selling out French farmers in trade talks.
There were more controversies arising from his time in Brussels. In 2006, it was reported that he received a free cruise on a yacht from an Italian mogul who was said to have benefited from tariffs on Chinese shoes when Mandelson was EU trade commissioner.
Image: Former Labour leader Neil Kinnock (L) with Peter Mandelson. Pic: PA
Reports also claimed he had been lent a private jet by banking and business tycoon Nat Rothschild. And it was later reported that he had a holiday in August 2008 on the yacht of Russian oligarch Oleg Deripaska off the Greek island of Corfu.
Mr Deripaska was said to have benefited from a cut in EU aluminium tariffs introduced by Mandelson. But prime minister Brown said Mandelson’s dealings with Mr Deripaska had been “found to be above board”.
After Brussels came perhaps his most spectacular and unexpected political comeback, when in 2008 his old foe Gordon Brown, by now prime minister but facing challenges to his leadership, brought him back as business secretary with a peerage.
A year later, Mr Brown awarded him the grand title, previously held by Michael Heseltine under John Major, of first secretary of state, a position he held until Labour’s election defeat in 2010.
To this day, Lord Mandelson remains a devoted Blairite rather than a soulmate of Mr Brown. And in the run-up to Sir Keir’s election victory last year he was back in the fold, offering advice on campaigning and policy.
He got his reward with the plum job of ambassador in Washington. But his links to a very American scandal, involving the disgraced financier and sex offender Epstein, have pushed him out of political life. Again.
Peter Mandelson’s position was completely unsustainable, but it took Sir Keir Starmer 24 hours after everybody else to realise the inevitable.
In the chaotic interim, this generated the extraordinary spectacle of No10 saying that they had full confidence in their man in Washington because – and it feels incredible to type this – No10 had been fully aware that the peer had an extended relationship with a convicted paedophile after the point he had been to jail in the US, and was content with this situation.
This is why the issue has become a matter of Starmer‘s judgement almost as much as Peter Mandelson‘s.
Indeed, there were echoes here of the Chris Pincher affair that led to Boris Johnson’s downfall – a leader stubbornly defending acts which revolted the bulk of the party, in a tone deaf act of self-harm.
And revolted, they were.
More on Labour
Related Topics:
Almost the entire Labour Party was reacting with horror at the revelation, and even more so at the defence.
Less than 24 hours before his departure, Starmer was saying: “The ambassador has repeatedly expressed his deep regret for association with him, he’s right to do so. I have confidence in him and he’s playing an important role in the UK-US relationship.”
Words of certainty – but done once again without access to full facts.
Please use Chrome browser for a more accessible video player
Dangerously, the PM was also defending a vetting process which would by implication put him in possession of facts that should have ruled Mandelson out of that job.
“Full due process has gone through when the appointment was made,” he said.
Now the line from a junior foreign office minister is that Mandelson hadn’t told him. So either the vetting failed or this isn’t quite accurate.
My understanding is that no one in government knows the last time Mandelson did see Epstein – the absence of certainty on that key fact must have set off alarm bells.
Right now, No10 will be thinking and hoping that, with just six days to go until the state visit by Donald Trump, which was meant to be organised by Mandelson, people will not focus too much on this question.
However, given the current rate of one big beast in government being sacked every week, this will ultimately land at Starmer’s feet.