M&S to make £100m cyber claim from Allianz and Beazley
Marks and Spencer is preparing to claim as much as £100m from its cyber insurance policy, following a major cyber attack that disrupted operations and led to the theft of some customer data.
The UK retailer admitted for the first time on Tuesday that personal information, including customer contact details, dates of birth, and online order histories, have been accessed by hackers in a breach that crippled its online system for nearly three weeks.
M&S stressed that payment details and account passwords, however, were not compromised.
The Financial Times reported that M&S’s cyber insurance policy, arranged by WTW, allows claims of up to £100m.
German insurer Allianz is reportedly the primary carrier on the policy, and will be expected to cover the first £10m of the claim.
Specialist Lloyd’s of London insurer Beazley is also among those exposed to the financial losses.
M&S set to reveal impact of losses
The FTSE 100 retailer’s full year results are due next week, and an update on the financial impact of the attack is to be expected.
Based on average daily revenue, analysts have estimated that the retail giant may have lost over £60m in online sales so far.
The hack also disrupted operations in physical shops, where some food outlets struggled to maintain normal stock levels.
The attack has damaged investor confidence, with M&S shares falling roughly 16 per cent since the breach on 22 April, wiping around £1.3bn off their market value.
M&S’s payout – perhaps one of the largest in the UK retail sector – could serve as a crucial test case for the industry.
A senior insurance market figure said the policy would likely pay out in full, if a third party vendor was ultimately found to be responsible for the breach.
The payout is expected to cover both direct business losses and third party liabilities.
Cyber attacks have cost UK businesses an estimated £44m in lost revenue over the past five years, according to a report by broker Howden, with over half of all UK firms experiencing at least one attack during that time.