M&S stages walk-in recruitment days after cyberattack stops online hiring

British retailer Marks & Spencer (M&S) now has to stage in-store recruitment open days to attract new staff. After a cyberattack in April, the company is still unable to take applications online.

After confirming a couple of weeks ago that April’s cyberattack would cost it around £300 million ($403 million) in profit, M&S is now facing additional issues.

Disruptions to the retailer’s systems are expected to last until July, so M&S was forced to – literally – return to using good old pen and paper. Online shopping was suspended after hackers hit the company in April – but so was online recruitment, it seems.

All job listings have been pulled from the website, and M&S stores are now posting on Facebook to advertise walk-in open days for “multiple vacancies.” For instance, the store in Shoreham held an event on May 28th, while another location in Peterborough is staging one on Wednesday.

“We are holding a recruitment day on Wednesday, 28th May 2025 between 9am-3pm. Head to the Shoreham store between these hours for an interview if you are interested!” the Shoreham store wrote on its Facebook page.

“Please can you ensure you bring all your Right to Work Documents so they can be checked during your interview if you are successful.”

The Peterborough store's page stated that it had “various roles, start/finish times and hours available.”

It also said there was no need to book an appointment: “Just turn up between the timeframe and head to the top floor until points.”

There are dozens of similar invitations. M&S stores maintain their own individual social media accounts.

M&S, which was trading strongly before the hack, said online disruption in its fashion, home, and beauty divisions would continue throughout June and into July as it restarts systems and then ramps up operations.

There are also questions regarding a potential fine from the United Kingdom’s Information Commissioner’s Office (ICO), which enforces data protection regulation. The fine could reach 4% of M&S’s annual turnover, meaning anything up to £552 million ($747 million).

Besides this, M&S is facing a multimillion-pound lawsuit following the theft of customer data since it was accessed and could be used in phishing attacks.

However, the ICO is unlikely to fine firms unless they’re actually at fault over a breach, and in this case, it looks like M&S hackers used employee logins from a third-party consulting firm.