Marks & Spencer’s chief digital and technology officer Rachel Higham is leaving the company months after a cyberattack that cost the retailer £300million.
The high street chain confirmed her departure in an internal memo circulated to staff on Thursday.
The announcement comes as the company continues to recover from the severe financial and operational impact of the April cyber breach.
The attack was claimed by the hacking group Scattered Spider and brought M&S’s internet-based retail operations to a standstill.
It blocked online sales, disrupted click-and-collect services and paralysed essential digital infrastructure for weeks.
The incident has been described by security experts as one of the most costly cyberattacks to affect a British retailer.
M&S has restored most online functions, though the company said the disruption left lasting financial consequences.
It expects insurance policies to cover a portion of the £300million loss but did not specify how much.
Ms Higham joined M&S at the beginning of 2024 as part of a wider push to modernise the company’s digital capabilities.
The company did not provide further details on the circumstances of her departure
| M&SShe had previously held senior roles at advertising group WPP and telecoms provider BT Group.
Her appointment formed part of the retailer’s long-term digital transformation programme, with a focus on strengthening e-commerce operations.
The internal announcement described her exit as “stepping back from her role” rather than a conventional resignation.
It said: “Rachel has been a steady hand and calm head at an extraordinary time for the business, and we wish her well for the future.”
The company did not provide further details on the circumstances of her departure.
M&S has also declined to comment on whether Ms Higham will receive any form of severance package.
Since the cyberattack, the retailer has reinstalled many aspects of its online service
| GETTYQuestions remain about succession planning within the company’s technology division.
In August, M&S told Sky News it had no immediate plans to recruit a replacement for the position.
The lack of clarity leaves uncertainty over leadership of the retailer’s digital and technology operations.
Industry observers say the timing of the departure, so soon after the cyberattack, raises questions about the future direction of the company’s digital strategy.
The April breach highlighted vulnerabilities within M&S’s online systems at a time when digital sales form an increasingly important part of its business model.
Online revenues have grown steadily in recent years as the retailer invests heavily in e-commerce and supply chain improvements.
The disruption underscored the risks facing large retailers as cybercriminal groups escalate attacks on major consumer brands.
The Scattered Spider group, which has been linked to high-profile breaches of global companies, claimed responsibility for the M&S attack.
The incident caused widespread disruption for customers, many of whom were unable to place or collect orders during the outage.
It also forced the company to delay several digital initiatives designed to expand its online reach.
Despite the setback, M&S has restored click-and-collect and other core functions in recent months.
The retailer said recovery efforts remain ongoing but insisted that customer-facing operations are returning to normal.
It was a ransomware attack on M&S. | GETTY/PA/REUTERSThe company continues to face scrutiny from investors and regulators about the strength of its cyber security measures.
Executives have pledged to implement stronger protections to reduce the risk of a repeat incident.
Analysts say the scale of the losses highlights the need for retailers to prioritise cyber resilience alongside digital growth.
M&S has not indicated whether it plans to restructure its technology leadership team following Ms Higham’s departure.
The company remains without a confirmed successor at a time when cyber security concerns remain central to its operations.
Her exit marks the end of a short tenure that began with optimism but was overshadowed by one of the most damaging cyberattacks ever to hit the British retail sector.