Safeguarding a High Street Darling: How M&S Are Managing Their Reputation During a Crisis

2025 has been a tough year for retailers, first Harrods and the Co-op, and now Marks & Spencer finds itself entering the sixth week of managing a cyber attack. 

While recent data from Fastly shows cyber attacks on retailers are sadly becoming more common, with 52% of retailers feel unprepared to deal with future attacks, what stands out here is M&S’s approach to crisis communications, and how they’ve woven their brand into it. 

This is M&S. The M&S that yearly delivers a Christmas ad worthy of a BAFTA. The M&S that shot a gelatinous pig to cult-like stardom, so it makes sense this isn’t just crisis comms – it’s an M&S crisis comms. 

Here are a few key takeaways from their approach so far:

Direct, Human Communication From the Front

Initial communications were directly from the CEO, signing himself off as Stuart, partnered later by practical guidance from the operations director Jayne Wall on how to stay safe online. Across these messages, the language used was clear, plainspoken and human, cutting through the complexity to explain the situation and, crucially, to reassure customers. 

“’We sincerely apologise for any inconvenience caused to you and all of our customers.” 

The “apology for inconvenience caused” line is such a standard in crisis commns, but a small nuance in it sometimes means it lands badly. Sometimes you see it as an apology ‘IF’ there was any inconvenience caused… here there is no question of that, and they go straight to the apology for the inconvenience to you and all customers  

The sign off in Jayne’s email  “’Thank you so much for shopping with us and for your support, we never take it for granted.” humanises the brand and reaffirms a tone of gratitude and service.

Not too little, not too much

M&S have nailed the goldilocks cadence when it has come to updates over the past six weeks. They haven’t overwhelmed audiences with constant noise, while keeping a constant flow of information, on the channels where their customers are (even extending to X/twitter). This balance between visibility and measured communication is key to avoiding creating unnecessary panic while keeping comms flowing.

Active not passive

“M&S has been managing a cyber incident.” 

Clear, straightforward, and crucially active: Compare that to more passive phrases like “We’re experiencing” or “We’ve been made aware”, which can suggest a business is caught off guard or struggling to respond. M&S positioned itself as in control, not under siege.

All in all, it’s the crisis comms equivalent of a warm, lemon and herb grilled chicken breast served with roasted vegetables, and a drizzle of tahini. 

But this is only the first course.

As Jon Tipple, Chief Strategy Officer at FutureBrand mentions, the reputation of any business in a crisis isn’t protected by initial actions, but by what follows after. How a business fixes the problem, how they talk about it over the next year will be far more important than the initial communication.

If you’d like more examples of best PR plays and case studies delivered straight to your inbox, you can sign up for With’s newsletter here: https://welcometowith.com/contact/