Marks and Spencer is set to claim up to £100m from its cyber insurance policy following a significant cyber attack that disrupted operations and resulted in the theft of some customer data.
The Ƶ retailer acknowledged for the first time on Tuesday that personal information, including customer contact details, dates of birth, and online order histories, had been accessed by hackers in a breach that incapacitated its online system for nearly three weeks, as reported by .
However, M&S e mphasised that payment details and account passwords were not compromised.
According to the Financial Times, M&S's cyber insurance policy, arranged by WTW, permits claims of up to £100m.
German insurer Allianz is reportedly the primary carrier on the policy and will be expected to cover the first £10m of the claim.
Specialist Lloyd's of London insurer Beazley is also among those exposed to the financial losses.
M&S set to reveal impact of losses
The FTSE 100 retailer's full-year results are due next week, and an update on the financial impact of the attack is anticipated.
Analysts have estimated that based on average daily revenue, the retail giant may have lost over £60m in online sales so far.
The hack also disrupted operations in physical shops, where some food outlets struggled to maintain normal stock levels.
The attack has undermined investor confidence, with M&S shares falling roughly 16 per cent since the breach on 22 April, erasing around £1.3bn from their market value.
The payout from M&S, potentially one of the largest in the Ƶ retail sector, could set a significant precedent for the industry.
A high-ranking figure in the insurance market suggested that the policy would likely pay out in full, if a third party vendor was ultimately found to be at fault for the breach.
The payout is anticipated to cover both direct business losses and third party liabilities.
Cyber attacks have cost Ƶ businesses an estimated £44m in lost revenue over the past five years, according to a report by broker Howden, with more than half of all Ƶ firms experiencing at least one attack during that period.
