The turnaround of Marks & Spencer, the 141-year-old stalwart of Britain’s high streets, had been going so well.
After years of false dawns, under the leadership of Stuart Machin the retailer has refreshed its brand, improved sales growth and snatched market share from rivals, while his five-year transformation plan was running ahead of schedule.
The food business has been helped by an improved perception of value for money as M&S has sought to position itself as somewhere to do a “big shop”, while better designs have increased the popularity of its clothing ranges, even with younger shoppers who had traditionally avoided it.
Tempus was a buyer of M&S shares in October 2024. It was an astute call, with the company enjoying “another good Christmas” and that was reflected in the share price, which rose by more than 10 per cent between October and mid-April.
This week’s annual results, for the year to the end of March, showed why the shares had been in favour with investors: both food and its clothing and home division ended the year in fine form and the annual pre-tax profit was £35 million more than most had expected at £875.5 million.
The new financial year had started in a similar vein. But then came the cyberattack over the Easter weekend, which has crippled the group’s online offering and led to empty shelves in its stores. Even now, a month on, customers still cannot place online orders and in-store food sales have been dented by the availability issues.
M&S estimates the attack will hit this year’s profits by about £300 million, although bosses hope they can recover about £100 million from their insurers.
But that is just the “current estimate”. Online disruption will continue until at least July and there is no guarantee that will even be the end of it. It also remains to be seen what the Information Commissioners Office does given M&S has confirmed that “personal customer data” was taken by the hackers.
The ICO has the power to impose a penalty of up to 4 per cent of a company’s global turnover if it is found not to have taken appropriate steps to prevent data breaches. In the case of M&S, which had revenues of £13.82 billion last year, that equates to a potential fine of almost £553 million.
Machin, 55, and his team are adamant that there will be no longer-term impact on customer sentiment, but investors would be forgiven for being a little more sceptical right now. Loyal customers will have had no choice but to look elsewhere in recent weeks, whether that be for their weekly food shop or new holiday clothes.
Once M&S is fully back up and running, will they return with the same enthusiasm they had before the cyberattack that allowed the retailer to so comfortably beat annual profit forecasts?
With a price-to-forward earnings ratio of 14.1 times, M&S shares are priced punchily, even after the post-cyberattack sell-off. Of the big British retailers, only Next’s shares trade on a higher multiple.
That is not to say M&S shares are expensive, but they do require earnings upgrades if they are to go higher, and that is not a given at the current time.
The shares are down a little more than 6 per cent since the cyberattack came to light but are still higher than even at the start of April. That does not feel quite right given the uncertainty hanging over the business.
As it stands, the consensus in the City is that pre-tax profits will fall to about £746 million in the current financial year, before rebounding to £978 million in its 2027 financial year and to more than £1 billion come 2028.
Given those lofty expectations, it is not unreasonable to want to see proof — rather than just relying on management’s belief — that M&S customers’ habits have not been permanently affected.
As such, it feels like the right time to move down to a “hold” recommendation. Existing shareholders may prefer to stay invested, but for prospective investors it might make sense to stay on the sidelines over summer until the full impact of the cyberattack starts to come out in the wash.
Advice: Hold
Why: Turnaround had been going well, but full impact from cyberattack still unknown
