Thought Leadership
The retail chain Marks & Spencer is ending its partnership with Tata Consultancy Services in the helpdesk sector. A hacker attack in spring cost the company around £300 million. However, both sides emphasize that the decision was made independently of the incident.
Marks & Spencer (M&S) has terminated its long-standing contract for IT helpdesk services with Indian outsourcing giant Tata Consultancy Services (TCS). The move follows a severe cyberattack that, according to M&S, cost approximately £300 million in spring and temporarily brought online operations to a complete standstill. However, both companies assure that the contract termination was decided before the attack and does not represent an assignment of blame.
Attackers deceived IT support with fake calls
In the attack, hackers from the group Scattered Spider allegedly penetrated M&S systems through social engineering. The perpetrators posed as senior managers in phone calls with IT support and manipulated employees into carrying out password reset processes.
The incident led to weeks of disruption in retail operations. M&S Chairman Archie Norman described the attack to Parliament as a “sophisticated impersonation operation involving a third party.” This phrasing put TCS in the spotlight, as its personnel operate the IT hotlines and have authorizations for security-critical processes such as password resets.
TCS: no vulnerabilities in own network
Following the incident, TCS launched an internal investigation and subsequently stated that it had found “no evidence of compromise in the TCS network.” The incident stemmed from vulnerabilities “in the customer’s environment.” TCS also clarified that it does not provide cybersecurity services to M&S.
Termination in July – tender process started in January
According to The Telegraph, M&S officially terminated the helpdesk contract in July, three months after the cyberattack. However, M&S states that it began searching for a new provider as early as January – well before the incident.
The partnership with Tata has existed for over ten years. Two years ago, both companies signed a new contract tasking TCS with modernizing M&S’s IT systems, including data centers and cloud services. Both parties want to maintain this overarching collaboration.
An M&S spokesperson explained that the company had, as usual, reviewed the market to find the best available solution. The decision has “no impact” on the continued TCS partnership. TCS confirmed that the tender process began several months before the cyberattack. The company continues to work with M&S as a strategic partner in numerous other areas.
