Geo Focus: The United Kingdom
,
Geo-Specific
,
Incident & Breach Response
Expert Lauds ‘Textbook Cyber Crisis Communications’ as M&S Details Some Disruption
It’s rare to see a corporation lauded for its hacking incident communications, but British retailer Marks & Spencer has executed an admirable version of what informing the world of bad news should look like.
See Also: Live Webinar | Resilience in Crisis: Recovering Your Minimum Viable Company Fast
The company announced that it “has been managing a cyberincident over the past few days” in a statement Tuesday to the London Stock Exchange.
Here’s what the retailer’s note lacked: marketing spin. At no point did the business begin playing data breach notification cliché bingo to try to minimize impact or culpability by normalizing cyberattacks, throwing up its hands in the face of hacker ninjas, proclaiming to “take the security of your information seriously,” or even pretending nothing happened (see: Cybersecurity Experts Slam Oracle’s Handling of Big Breach).
Instead, Marks & Spencer has been playing it straight, saying it’s brought in “external cybersecurity experts to assist with investigating and managing the incident” while “taking actions to further protect our network and ensure we can continue to maintain customer service.” Also reassuring: the organization said it’s working with the U.K. National Cyber Security Centre – part of intelligence agency GCHQ – which is the national incident response lead.
A fixture on the British high street for 140 years, M&S later on Tuesday notified customers directly about the cybersecurity incident and said there could be “limited” delays for pickup orders placed on its website. Some customers have reported being at least temporarily unable to use contactless card payments, as well as gift cards or store vouchers.
“To protect you and the business, it was necessary to temporarily make some small changes to our store operations, and I am sincerely sorry if you experienced any inconvenience,” said the email, signed by CEO Stuart Machin. “Importantly, our stores remain open, and our website and app are operating as normal.”
The message added that “there is no need for you to take any action at this time and if the situation changes, we will let you know.”
Lauding the company’s “great communication” in the early hours and days of dealing with a security incident, Jude McCorry, CEO of Scotland’s Edinburgh-based Cyber and Fraud Centre, which provides incident response and cybersecurity support to Scottish organizations, said the retailer is being “clear, concise, factual and owning it,” and not only in its online communications.
“I was in their Gyle store on Sunday, met by staff on the way in to let me know contactless was not available – but it was business as usual looking after their customers, and keeping the show on the road,” she said. “I’m sure in the background it’s not as calm, but well done on everything so far.”
The cybersecurity incident appears to have unfolded during the holiday weekend. One customer who went to an M&S store in Plymouth, England, on Saturday said, “Could not collect my online purchase today, previous visit could not return an item as tills were down.”
The company appears to have fully activated its incident response plan by the next day, which included the reaching out directly to customers through an email.
William Dixon, a senior associate fellow at the Royal United Services Institute, a British think tank, said on LinkedIn that the note from M&S demonstrated “textbook cyber crisis communications,” including “empathy and responsibility” by remaining “transparent” and sticking to facts – not speculation – while staying reassuring. “It acknowledges the incident without dramatizing it, and emphasizes that all core services are still running,” he said.
“Bravo to the team there,” he added. “I know many drafts will have been written, edited and poured over before the send button was hit to the tens of millions of customers.”
“It is very refreshing to see a company taking an approach like this,” said British security researcher and Black Hat conference review board member Daniel Cuthbert. “Not trying to hide the breach or hide behind strong legal/PR messages.”