Archie Norman, M&S Chairman: “Insure for a cyber catastrophe”

Archie Norman, Chairman of M&S, offered two clear pieces of advice to retailers on cyber resilience, one year on from one of the retail sector’s most high-profile cyber incidents:

1. Check your cyber insurance and insure for a catastrophe, not a minor loss
2. Never assume your systems are impregnable. Plan for what happens when attackers get in

Reflecting on the infamous M&S cyber attack in a fireside chat with Kate Hardcastle MBE at the Retail Technology Show,  Archie Norman described the cyber incident one year ago as “traumatising and stressful” as he recalls watching M&S, quite literally, being turned off. “The aftermath lasted months, a year. Even now, there are traces of it around the business,” he admitted.

“Unbeknown to me, in a stroke of genius, our corporate counsel had doubled our insurance. We were insured for a cap of £100m, and as you know, that was paid out.”

But, he stressed, this was far from sufficient. “It’s not the first ten to twenty million you should insure for. It’s the catastrophe. Insure for one hundred, two hundred, three hundred million. In our case, this cost over £300m. And that’s before you look at business impact, business value and brand impact.”

While insurance provided a level of critical financial protection, the scale and duration of the operational disruption was huge.

Prepare for the worst

Norman reflected that the degradation of systems forced core processes offline. “Ordering systems went manual, back to paper, pens and clipboards.”

His advice to other retailers was simple: assume failure.

“Assume your systems will get shut down, think about the end point, and assume that the rebuild will cost you a lot of money.”

Crucially, he noted that most modern attacks are not driven by technical failure, but by exploitation of people. “Most attacks are impersonations, clever fraud. Assuming no-one can get in [to your systems] is a false assumption.”

For M&S, that meant an attack surface of 50,000 people, a reminder that identity risk now sits alongside, and often above, traditional infrastructure risk.

Norman also challenged the value of traditional cyber exercises. “You’ll probably have had consultants come in and game-play a red team attack. But it’s nothing like that. In that moment, you can forget all that. It was totally unlike anything you will have practised.”

While reluctant to call the year “lost”, he acknowledged that “we would be further ahead in our journey if it hadn’t happened.”