M&S chief digital and technology officer steps down in wake of damaging cyberattack

• M&S confirms Rachel Higham stepping down after leading digital and technology for two years
• Retailer announces leadership reshuffle with senior executive set to take over
• Higham’s departure follows devastating cyberattack disruption that began in May

Marks & Spencer has said that Rachel Higham, its chief digital and technology officer, is leaving the retailer just over two years after joining.

Higham, who arrived at the business in June 2023, will be taking a career break, the company said.

“Rachel has decided to take a break and is stepping back from her role, having been a valued part of the leadership team,” an M&S spokesperson said in a statement. “She has been a steady hand and calm head at an extraordinary time for the business and we wish her well for the future.”

Ransomware attack

Her departure comes in the wake of a damaging and well publicized cyberattack earlier this year that disrupted services and compromised customer data.

The attack forced M&S to suspend online orders, disable click-and-collect functions, and restrict some in-store contactless payments.

Product availability was also affected as systems were taken offline.

Shortly after announcing the cyberattack in May, the retailer acknowledged that personally identifiable information had been stolen by cybercriminals, but stressed at the time that payment card details, passwords, and one-time passcodes were not part of the breach.

Customers were advised that no immediate action was necessary, although those returning to the M&S website were required to reset their passwords as an added measure.

Cybersecurity analysts said the incident bore hallmarks of a ransomware attack, although the company declined to say whether a ransom was paid. M&S chairman Archie Norman told lawmakers that discussing such matters would not be in the public interest.

The incident prompted wider discussion about growing threats in the retail sector, with Camellia Chan, chief executive of AI security company X-PHY, saying, “Prevention must be built in from the ground up. Businesses need a multi-layered approach that combines hardware-level security to detect and block attacks early. This should be combined with an AI-driven threat detection layer that automate detection and enforce policies in real time. With human-error contributing to 95% of data breaches, this removes the burden of constant vigilance from employees and constant resilience testing.“

According to Reuters, Higham’s departure has triggered a leadership reshuffle. Veteran executive Sacha Berendji will now oversee digital and technology alongside property and store development. Retail director Thinus Keeve will report directly to Chief Executive Stuart Machin.

Shares in M&S have fallen more than 8% this year as the retailer continues to manage the fallout.

You might also like

• Take a look at our picks for the best malware removal software around
• Check out our choice for best antivirus software
• Customer data stolen in M&S cyberattack