A cyber-attack can affect any organisation and leave customers in the lurch, but how they respond during such an incident can make or break an established reputation. The attack on Marks & Spencer’s operations, with the disruption now rumbling on into its third week, has been a true test of its reputation as a trusted UK brand that puts its customers first.

Chief executive Stuart Machin was quick to acknowledge the incident with customers as well as the impact it had on operations. The statement, shared on social media, its website and via email was transparent in explaining exactly what had happened and provided important information about which services had been impacted.

By putting Machin front-and-centre of these communications, it sends a message to audiences that the head of the organisation is leading a response that serves the best interests of both its staff and customers.

The retailer reported the incident to the National Cyber Security Centre and relevant data protection supervisory authorities, which had been confirmed in the immediate media reports, thereby meeting its regulatory obligations and reassuring customers that the correct procedures have been followed.

Clear, rapid communication for clarity

Silence can be damaging. Clear, rapid communication during crisis scenarios is essential to prevent speculation and reduce opportunities for fake news to spread.

The rapid dissemination of disinformation, where people intentionally spread falsehoods, is affecting the business sector more than ever. Organisations therefore need to be prepared with crisis communications that can be relied upon and ready to deploy at a moment’s notice.

In this case, M&S took ownership of its messaging around the incident to help shield its customers from false claims before speculation started. It was likely a thoroughly rehearsed plan to meet customer expectations for honesty, leadership and proactive communication, particularly in the absence of an immediate fix.

While M&S will have hoped to resolve the situation ahead of its next public communications, it wasn’t to be. The retailer has continued to battle disruption since the initial attack, which has been reflected in the resulting news coverage. This is where brands need to find the balance between communicating regularly without making false promises or assurances. It’s a very easy trap to fall into, but the last thing brands should do is set timelines for services to be back up running, before the full extent of the issue has been thoroughly investigated and a resolution is clear. Should broken promises or long periods of silence occur after setting such expectations, brands almost certainly bring about long-term reputational damage and erode customer trust.

The value of best-practice planning

Reputational damage awaits organisations that handle cyber-attacks poorly. But, if handled well, businesses can turn a potentially disastrous situation into a defiant show of resilience. Even negative press coverage in the short-term can have a long-lasting impact, and the internet has a habit of resurfacing information that can strike another blow to a brand’s reputation, especially in cases where the initial public-facing communication was deemed insufficient. So far, M&S has shown the value in having a thorough crisis comms plan to buy itself crucial time for investigation.

Managing crisis communications effectively

M&S’s response to its recent cyber-attack serves as a prime example of how to manage immediate crisis communications effectively. By acting swiftly, being transparent and providing regular updates, the retailer has both managed customer expectations and reinforced its brand values of caring about its staff and prioritising customer service.

While ongoing disruption continues to challenge the brand, its clear and proactive approach has helped mitigate the risks of reputational damage and demonstrated resilience — so far. The question now becomes about how quickly M&S can resolve all its service issues, ensuring this month’s attack is an incident that doesn’t live in the minds of consumers for years to come.