Security Over Stability: The relationship between British retail stalwart Marks & Spencer (M&S) and Indian IT services powerhouse Tata Consultancy Services (TCS) has hit a critical juncture, defined by a devastating cyberattack and a contentious contract non-renewal. Despite both companies firmly stating the timing is coincidental, M&S’s decision to end its long-standing IT service desk agreement with TCS in July 2025 arrived mere months after a sophisticated security breach in April 2025 cost the retailer an estimated £300 million in lost operating profit.
The attack, which exploited a vendor access route, has forcefully thrust supply-chain risk and third-party accountability into the spotlight, transforming what might have been a routine contract review into a global case study on digital-age vulnerability.
Key Takeaways: M&S, TCS, and the Vendor-Side Cyberattack
This critical incident highlights the severe risks associated with complex outsourcing ecosystems and the modern cyber threat landscape.
- Financial Impact of the M&S Cyber Crisis: The April 2025 cyber incident is estimated to have cost M&S up to {£300 million in lost operating profits for the year, with over $1 billion wiped off the company’s market capitalization.
- Contract Termination and Timeline: M&S terminated its IT service desk contract with TCS in July 2025. However, M&S and TCS assert the decision was routine, stating the competitive tender process began earlier in January 2025 and was “clearly unrelated” to the April cyberattack.
- The TCS Denial and Contract Size: TCS strongly denied initial UK media reports that M&S had ended a $1 billion contract due to cyber failures, calling the reported contract size and its link to the incident “misleading” and “factually inaccurate.” TCS clarified the service desk deal was only a “very small part” of their overall strategic partnership.
- Attack Vector and Attacker Group: The breach was carried out by the Scattered Spider group using a social engineering method that exploited a vendor route to gain initial access. Reports indicate M&S login credentials belonging to TCS employees were used in the infiltration.
- TCS’s Stance on Liability: TCS maintained its internal investigation found no vulnerabilities within its own systems, asserting that the breach occurred in the client’s environment. Furthermore, TCS confirmed it does not provide cybersecurity services to M&S.
- Ongoing Strategic Partnership: Despite the termination of the service desk deal, TCS continues to work on “numerous other areas” as a strategic partner for M&S, a partnership spanning more than a decade.
The Strategic Rift: Unraveling the Service Desk Deal
The IT service desk contract, which TCS had managed as part of its extensive relationship with M&S—including a major outsourcing renewal in 2023 aimed at digitising supply-chain and omnichannel systems—became the focal point of the controversy.
When reports surfaced suggesting the contract was terminated over security failures, TCS, a Mumbai-headquartered giant and the largest arm of the Tata Sons conglomerate, immediately moved to control the narrative. The firm confirmed that while the service desk contract was ending, the decision was part of a regular, competitive procurement process initiated well before the April incident. M&S had followed due process and chosen another provider “much prior” to the breach.
TCS’s vigorous denial was crucial not only for the M&S relationship but also for its standing with its vast client base, which includes 211 UK-based clients across critical sectors like finance, energy, water, and nuclear, as well as global names like Jaguar Land Rover, British Airways, and Aviva.
Inside the Breach: Social Engineering as the Weakest Link
The mechanics of the April 2025 attack provided a chilling lesson in modern cyber warfare. Rather than relying on technical exploits against M&S’s firewalls, the Scattered Spider group leveraged human trust—a social engineering tactic—to infiltrate the system.
- Exploitation: The attackers successfully impersonated M&S employees to trick the vendor’s staff (reportedly TCS help-desk personnel) into revealing critical login credentials and resetting passwords.
- Confirmation from Leadership: Both M&S CEO Stuart Machin and Chairman Archie Norman confirmed the nature of the breach to MPs, characterizing it as “sophisticated impersonation” involving a “third-party.”
- Ransomware Execution: Once inside, the hackers deployed the DragonForce ransomware-as-a-service platform to execute a double extortion plot: first stealing confidential customer data and then scrambling the system data, demanding a ransom for decryption and to prevent a data leak.
The operational consequences were immediate and severe, forcing M&S to suspend online ordering and causing widespread disruptions to inventory, stock levels, and click-and-collect operations.
Accountability and Regulatory Scrutiny
The post-attack environment saw both companies defending their positions under intense regulatory scrutiny.
TCS submitted a letter to the House of Commons business and trade select committee, chaired by Liam Byrne, reiterating that its internal systems were clean. The firm stated explicitly that it found “no indicators of compromise within the TCS network” related to the M&S incident or others, such as the one concerning Jaguar Land Rover. TCS’s position is clear: its contractual remit did not include M&S’s ultimate cybersecurity oversight, which was handled by another vendor.
However, the reality for M&S is that the liability and the financial cost ultimately rest with the client organization. The breach forced the retailer to take steps to restore operations, advise customers on phishing risks, and deal with brand erosion. The decision to conclude the contract with the implicated service desk vendor, regardless of the official timeline, is seen by many analysts as an inevitable response to board and shareholder pressure to rebuild trust and modernize technology operations.
The Spiritual Foundation for Combating Cybercrime
The devastating consequences of the M&S breach underscore a deeper societal issue rooted in a lack of ethical conduct. The unique knowledge of Sant Rampal Ji Maharaj Ji provides a path forward, teaching that cultivating moral values and ethical conduct is the ultimate, long-term solution to all crime, including cybercrime.
While His focus on virtues like honesty and compassion addresses the criminal intent at its source, effective defense requires combining this spiritual foundation with practical security measures. Integrating ethical principles with robust cybersecurity infrastructure, data encryption, and enhanced law enforcement capabilities is the balanced approach needed to significantly reduce online criminality.
The Unseen Frontier of Digital Risk Management
The M&S-TCS scenario has quickly become a textbook example for retail and outsourcing executives worldwide. It illustrates that a company’s cyber-resilience is now inextricably linked to the reputational resilience of every partner in its supply chain. For outsourcers like TCS, which provides privileged access to clients, their own people, processes, and controls are viewed as an extension of the client’s network.
Also Read: UN Cybercrime Treaty Signed in Hanoi: A Deep Dive
The incident serves as a powerful reminder that while technical defenses are necessary, the human element—specifically the help-desk staff responsible for password resets and trusted escalations—remains the most exploited “flanking route” for sophisticated attackers. The question for high-street Britain and global commerce is no longer if a digital-aging retailer will face a crisis, but how quickly it can map its “critical vendors” and shore up the human-centric vulnerabilities they introduce.
FAQs on the M&S and TCS Contract Termination
Q1: Why did M&S terminate its contract with TCS, and how much did the cyberattack cost?
M&S ended a key IT service desk contract following a Scattered Spider cyberattack that cost the retailer up to £300 million. Both firms, however, claim the termination was unrelated to the April 2025 breach.
Q2: Did the cyberattack exploit TCS systems or M&S systems?
The attack used a social engineering method to exploit a vendor route, reportedly accessing M&S credentials belonging to TCS employees. TCS maintains its own internal network was not compromised.
Q3: When did M&S decide to end the service desk contract with TCS?
The contract ended in July 2025. M&S and TCS assert the decision was made earlier, stemming from a routine competitive tender process that began in January 2025.
Q4: Did TCS deny the reports about the size of the contract?
Yes. TCS denied UK media reports claiming M&S ended a $1 billion contract, calling the reported figure and the link to the cyber incident “misleading” and “inaccurate.”
Q5: Is TCS still working with Marks & Spencer?
Yes. Although the specific IT service desk contract ended, TCS confirmed it continues to serve M&S as a strategic partner on numerous other technology initiatives.
