Marks & Spencer CEO loses annual bonus after $175M cyberattack
Stuart Machin, the CEO of Marks & Spencer, received no bonus last year because of the cybersecurity incident that hit the retailer in April 2025.
Image by Marks & Spencer
Stuart Machin, the CEO of Marks & Spencer, received no bonus last year because of the cybersecurity incident that hit the retailer in April 2025.
- Marks & Spencer says the incident cost about £131 million ($175 million) in response and recovery efforts.
- Online services, systems, and product availability were affected well into the financial year, not just during the initial attack.
- The company’s remuneration committee said it would not be appropriate to award CEO Stuart Machin a bonus, despite him still receiving nearly £4 million in total pay.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
According to Marks & Spencer’s 2026 Financial Statements report, 2025/26 has been a challenging year for the company, calling it an “all hands on deck” moment, requiring intensive involvement from the company’s leadership and employees.
Despite all efforts, the effects of the incident lasted much longer than anticipated. Disruptions to trading, product availability, and systems continued to affect the business up to the end of the fiscal year.
The cybersecurity incident cost the retail shop £131.3 ($174.52) million in response, recovery, remediation, and related expenses. On top of that, profits fell from £881.1 million in the previous year to £671.4 million ($901,39).
Because of these developments, Stuart Machin, CEO of Marks & Spencer, won’t be receiving a bonus this year.
The Remuneration Committee, a group that decides how and how much senior executives are paid for their work, concluded that “it would not be appropriate” to award a bonus to Machin due to the cybersecurity incident last year.
“During the cyber incident, colleagues responded with exceptional commitment and resilience, led by an outstanding management team who together kept the business trading in the most difficult of times,” the Remuneration Committee says.
“However, it was concluded that, in the circumstances, and having particular regard to the experience of our shareholders, it would not be appropriate to make a bonus payment in respect of 2025/26,” the committee continues.
Should we feel bad for Machin? Not quite.
According to the financial statements, the CEO was paid a total of £3.968 million in 2025/26, despite receiving no additional bonus. This is a significant drop compared to the year before, though, when he received a total of £7.047 million. That year, Machin got a bonus of £1.635 million.
In April 2025, Marks & Spencer was attacked by Scattered Spider. The ransomware extortion group forced the business to shut down its online shop, app, and partially empty shelves in physical stores.
It wasn’t until August 12th that the business fully restored its online shop.
Machin called the cybersecurity incident “a bump in the road” and promised stakeholders that Marks & Spencer would “come out of this in better shape.”
Unlock more exclusive Cybernews content on YouTube.