After the cyberattack: the long road back to service

After the cyberattack, who pays? · Part 5/8

A backup preserves files; turning them into a usable service can require a much larger rebuilding effort. Documents from the British Library, M&S and JLR trace that work, while a public rate card reveals what an incident response contract buys.

In December 2023, the British Library confirmed that usable backups had been identified for its digital collections and their metadata, unaffected by the cyberattack of 28 October. This answered a fundamental question about preservation. Making the documents available again required another kind of work: in its incident review, published on 8 March 2024, the Library described extensive damage to its infrastructure and ageing applications that could no longer run in the secure environment it was building. The copies had survived; the means of using them had to be rebuilt. 1

That gap between a preserved file and a functioning service is the subject of the fifth instalment in our investigation. Having followed suppliers, insurance and the measurement of the economic shock, we now examine the work organisations buy or undertake to resume operations: technical investigation, restoration, data reconciliation, legal advice and the rebuilding of business systems. Public documents reveal several of these mechanisms and some of their prices. They also expose the distinctions between an expense recognised in the accounts, a contract awarded and the value of a service actually restored.

The files need somewhere to run

The British Library’s account shows how many elements must come together to deliver a service. A collection needs its files, the information describing them, a catalogue through which to find them, compatible applications and infrastructure capable of running those applications. The incident review explains that some essential software had lost vendor support or could not operate within the new architecture. It also distinguishes having copies available from fully validating them, a process that would continue as each dataset returned to use. 1

The work becomes easier to grasp from the reader’s perspective. Someone searches for a reference, identifies a document and requests access to it. Each action depends on several components working together. Rebuilding therefore involves testing the whole journey through to the function the user expects. These dependencies help explain why restoring files can precede the restoration of access by a considerable interval.

The UK National Cyber Security Centre makes the same point in its operational guidance, reviewed on 1 October 2026: recovery should begin with business priorities and the dependencies between systems. Investigators need to establish what happened and inform the recovery; restoration teams need an environment whose security has been sufficiently established. The condition of the backups matters alongside the ability to use them. 11

NCSC then recommends aiming for minimum viable operations (MVO): a sufficiently safe level of activity to meet the organisation’s obligations and retain its partners’ confidence. Those partners may seek independent assurance before reconnecting their own systems. An organisation can consequently have its computers running again while still completing the work required to reopen its exchanges with others. 12

Method and scope

Several dependencies stand between a retained copy and the reader. The 8 March 2024 review describes safe copies of digital collections and metadata, infrastructure to rebuild, and applications to adapt, migrate or replace. The drawing organises those dependencies through to search, request and access functions. An interim route combines a searchable catalogue with manual requests for available material, while cloud email, finance and payroll are functioning normally at the time of the review. The arrows explain the mechanism; their arrangement is schematic.

Figure fonts and licences

Figure fonts: Inter Variable and JetBrains Mono Variable, under the SIL Open Font License 1.1. Inter · JetBrains Mono.

Looking at recovery this way also clarifies the role of temporary arrangements. They let staff work while permanent applications are repaired or replaced, but generate information that will eventually need to be brought back into those systems: orders recorded through another process, data held in temporary tools and transactions awaiting reconciliation. NCSC points out that clearing this backlog can demand substantial effort. An overly ambitious technological transformation can also lengthen the rebuild. 13

At M&S, restoring systems and confidence in the accounts

Marks & Spencer provides a documented measure of the resources absorbed by technical recovery. For the 52 weeks ended 28 March 2026, the group reported £131.3 million of costs directly associated with the cyberattack, including £109.3 million for immediate systems response and recovery. The results published on 20 May allow a £22 million residual to be calculated. The company describes those remaining charges as third-party costs, predominantly for specialist legal and professional services. Its disclosure retains that broad definition; the amount attributable specifically to lawyers remains unknown. 18

Systems response and recovery thus account for 83.2% of this direct-cost category, according to our calculation. The denominator has a defined boundary: the interruption’s effects on sales and trading belong to a different measure. Similarly, the £109.3 million combines work for which this breakdown does not disclose the split between internal resources and outside providers. These are expenses recognised during the financial year, offering only a partial view of when payments were made. 18

The annual report adds a more tangible account through Deloitte, the financial auditor. Taking systems offline increased reliance on manual processes before a gradual return to automation. In checking the accounts, Deloitte says it attended more physical inventory counts, examined purchase orders and invoices, and obtained balance confirmations directly from suppliers. It also tested incident-related expenses to assess whether they were incremental and directly attributable to the attack. 5

These procedures reveal a practical dimension of recovery. A restarted system must once again account for goods, purchases and payment obligations. Evidence comes from stores, commercial documents and counterparties, as well as from applications. The work Deloitte describes forms part of the financial audit; any additional fees for it would need to be identified separately. Within the scope and materiality thresholds of its audit, Deloitte concluded that it had identified no material misstatement resulting from the incident. 5

Method and scope

The bar splits the direct costs recognised by M&S for the 52 weeks ended 28 March 2026. The £22.0 million residual and 83.2% share are calculated; the residual concerns third-party costs, predominantly specialist legal and professional services. The internal and external split of the £109.3 million remains unknown. The second panel describes financial audit work without pricing it or assigning it to either segment of the bar. Calculations, in millions of pounds: 131.3 − 109.3 = 22.0; 109.3 ÷ 131.3 × 100 = 83.244…%, rounded to 83.2%. The ratio concerns only M&S’s recognised direct costs for these 52 weeks.

Part of the cost of restarting is therefore the work of reconciliation: bringing what an organisation continued to do during the crisis into line with what its systems can now record and substantiate. This largely unseen effort underpins the confidence both the business and its partners can place in subsequent transactions. It also suggests a precise line of inquiry: which tasks are included in the published amounts, and what evidence establishes that each has been completed?

Buying response capacity before the first intervention

Victims’ reports disclose aggregate amounts. A supplier’s rate card offers a closer look at how a service is assembled. We examined NCC Group’s publicly available incident-response offering under the UK’s G-Cloud 14 framework, together with its terms and service definition, as available on 19 October 2026. These are published prices for a particular offering, subject to the agreed scope of work. They explain the structure of a purchase; the invoices and client contract would establish the prices actually charged. 8 9 10

The Bronze package combines a £9,500 annual retainer fee with at least three prepaid days at £2,200 each. The arithmetic gives a minimum commitment of £16,100 excluding VAT. The rate card covers one legal entity and sets conditions that take account of factors including the organisation’s size and geographical reach. Emergency response without a retainer is also listed at £2,200 per day. 8

The price brings together two useful functions: arranging access to expertise and paying for working time that can be called upon. The service definition describes familiarity with the client’s environment, scoping, support during the response and a final report. The terms distinguish the annual fee from prepaid hours and provide for billing at signature and on subsequent anniversaries; additional work depends on the document defining the engagement. 9 10

This structure helps put the commercial promise in context. An agreed availability arrangement organises how a team is brought in and begins its work. Restoring a service then depends on what the team discovers, which data can be used, which applications need rebuilding and the other teams it must work with. The contract arranges response capacity; the recovery programme must turn that capacity into functioning operations. 10 12

Method and scope

Arranged access, followed by billable work. NCC’s G-Cloud 14 Bronze tariff combines a £9,500 annual commitment with at least three prepaid consultancy days at £2,200: an arithmetic minimum of £16,100 excluding VAT. The top bar preserves those proportions. The circuit shows the contractual organisation of work and an initial balance of three days, without simulating actual consumption. The calendar represents an ordinary week without a bank holiday, using the published 09:00–17:30 UK office-hours window. Work outside that window, at weekends or on bank holidays carries a £4,400 day rate. Scope, expenses and additional services remain subject to agreement. Calculations in pounds excluding VAT: 9,500 + 3 × 2,200 = 16,100; 2 × 2,200 = 4,400. A minimum commitment and an increased day rate, without a bill ceiling or observed expenditure at a victim organisation.

Timing also changes the price. NCC’s document defines normal office hours as Monday to Friday, 09:00–17:30 UK time, with the daily rate doubled outside that window, at weekends and on public holidays. For Bronze, that means £4,400 for an applicable day, calculated from £2,200. Travel and accommodation expenses may be added. The duration of an outage therefore provides an insufficient basis for reconstructing the bill: that would require the time actually charged, the skills and people involved, and the scope accepted by the client. 8

The standard terms qualify response-time commitments when a large-scale event affecting the majority of incident-response clients causes, in NCC’s reasonable opinion, an exceptional influx of requests. The clause makes a risk to shared response capacity visible within an individual contract. The documents examined provide no example of NCC invoking it, but they raise the question of specialist availability when several clients need help simultaneously. 9

NCC appears in the British Library’s incident review, which says it engaged the firm immediately after discovering the attack, following consultation with NCSC. The connection identifies a provider and a later public version of its offering. The fee for its work at the Library remains unknown in the documents examined; the Library’s contract and invoices would be needed to establish the actual cost of that engagement. 1 8

Legal advice, negotiation and the usefulness of a decryptor

The precise purpose of the legal services in M&S’s breakdown remains to be documented. Advice on whether to make a payment is a separate question, addressed by guidance published in May 2024 by NCSC with UK insurance organisations. It asks victims considering payment to assemble the relevant operational, financial and legal information, consult appropriate specialists and examine alternative routes to recovery. Advisers’ work, in this setting, is to make a decision as well informed as possible while the damage continues to develop. 14

The guidance points out that deploying a decryption tool across a complex network can take time; backups may sometimes offer a faster route. Possessing a key creates a technical possibility whose practical usefulness depends on the systems and data concerned. Other aspects of the incident still require attention, including compromised access and the consequences of information being disclosed. 14

The economics of these services are particularly difficult to reconstruct from the available documents. Establishing the price of a negotiation would require the terms of the engagement and its remuneration, followed by verifiable evidence with which to assess the outcome. The selected sources disclose no individual negotiator’s fee, commission or legal rate specific to JLR, M&S or the British Library. M&S’s residual therefore retains its broad description as third-party expenditure, predominantly for specialist legal and professional services. 18

That degree of precision matters when considering the interests involved. A possible payment to criminals, an adviser’s remuneration and the spending needed to regain a service are different flows. Assessing them would mean tracing who made the decisions, who accepted the work and what was obtained. NCSC’s guidance supplies criteria for making a decision; companies’ aggregate amounts reveal only part of the resources committed.

Rebuilding as services return

At the British Library, work to restore access proceeded along several fronts. The programme approved by its board on 20 December 2023, and described in the following March’s incident review, combined an immediate response with an adaptation phase planned for six months and a renewal phase planned for eighteen. Adaptation was intended to provide interim solutions; renewal would establish durable infrastructure and applications. These durations belong to a historical plan in which the phases were explicitly concurrent. 1

The arrangement responds to a straightforward tension. Each temporary service can restore some of the institution’s usefulness while the foundations for its permanent replacement remain under construction. Readers need to know what they can access today. The teams responsible must also consider the migration that will preserve that access tomorrow. Tracking recovery therefore means following functions and the conditions under which they can be used, with several possible milestones within a single institution.

Public procurement makes part of this rebuilding visible. A Web Foundations contract was awarded to Q42 for £396,908 excluding VAT, signed on 11 November 2024. Another contract, awarded on 20 November to Ex Libris UK, covers Alma, Primo and Rapido for £2,659,973, over the period from 30 November 2024 to 29 November 2026. The notices identify contractual commitments and suppliers; records of delivery and payment would be needed to establish the expenditure actually incurred. The VAT basis of the second amount is not stated in the official JSON collected. 15 16

These commitments overlap with a transformation that was already planned. The incident review and 2023/24 accounts explain that the Library had allocated funds to renew equipment and applications, and that the attack led it to accelerate part of that planned programme. The 2025/26 accounts subsequently reported £4.2 million of technology capital expenditure, compared with £0.7 million the previous year, linking the increase to rebuilding. The category covers a range of work and assets; its scope is broader than expenditure isolating the additional cost of the attack. 1 2 3

Following services gives another view of what that work has delivered. A searchable catalogue returned on 15 January 2024. The 2025/26 annual report then describes the launch of a new platform in December 2025. On 8 July 2026, the Library announced the return of EThOS as a service providing records and links to university repositories. The platform provides a route for finding theses again, with access to full text dependent on the institutions concerned. These three milestones describe different capabilities. 1 3 4

Method and scope

Two readings of reconstruction time. The programme approved on 20 December 2023 and described on 8 March 2024 organises three concurrent workstreams: Respond, with no quantified duration; Adapt, planned over six months; and Renew, over eighteen months. The two bars share a graphical origin to compare announced durations, preserving an exact one-to-three ratio. The lower timeline uses a linear calendar scale and documented milestones: a searchable catalogue on 15 January 2024, a new main catalogue in December 2025, and the 8 July 2026 announcement of EThOS returning with records and links to university repositories. The December band covers the entire month. Each milestone concerns its own service perimeter; EThOS hosts records and points to files available elsewhere.

The elapsed time becomes more intelligible when seen through these functions than through a single availability indicator. A reader may be able to find a reference before all the means of ordering or consulting it are restored. An application can be modernised while a temporary tool continues alongside it. Assessing a programme’s results involves connecting the money committed to the functions that have returned, their limitations and the work still required.

At JLR, work continues after the exceptional charge

JLR brings this distinction back to the central case of our series. For the year ended 31 March 2026, the manufacturer reported £260 million of exceptional charges associated with the incident. The note includes third-party claims and obligations alongside professional fees. Recurring spending to strengthen IT and cyber security, together with indirect effects on performance, receives different treatment. The £260 million therefore cannot be treated as the remuneration of incident-response teams. 6

The quarterly report published on 13 August 2026 adds another piece of evidence. It describes investigation, recovery and remediation as ongoing, alongside work to strengthen resilience. Its financial note records no exceptional items for the three months ended 30 June. The two statements are compatible because the financial category and operational progress answer different questions. The document confirms that work continues without isolating a subsequent budget for it. 7

For this investigation, the absence of a new exceptional charge during that quarter therefore provides a financial-reporting milestone. Establishing that the work itself is complete would require other evidence: restored functions, verified dependencies, data from temporary processes brought back into the systems and the ability to sustain operations over time. These are the outcomes NCSC’s recovery guidance asks organisations to plan for and test. 12 13

The issue now extends beyond the victims whose documents we have examined. In his Mansion House speech on 14 July 2026, Bank of England Governor Andrew Bailey called for substantially stronger recovery capabilities and referred to rebuilding systems from scratch, known as bare-metal recovery. He was setting out a direction for resilience; the speech alone establishes no new regulatory obligation. 17

The British Library and M&S cases give that ambition practical substance: reassembling usable services and restoring confidence in their operations. Specialists, internal teams and partners contribute expertise whose usefulness is visible in the documents, although those documents do not allow the return on each item of spending to be measured. That leaves a precise question for buyers and providers: what work was paid for, which function did it make possible, and what evidence was used to validate the recovery?

Method and scope

This documentary investigation has an information cutoff of 19 October 2026. It draws on eighteen selected primary references: accounts and audit reports, the British Library’s incident review, service announcements, public procurement notices, commercial documents, NCSC guidance and a Bank of England speech. Organisations’ statements are attributed to their authors, and the auditor’s conclusions are presented within their own scope.

The calculations are confined to the M&S breakdown and arithmetic explicitly derived from NCC’s rate card. Their formulas and denominators appear beneath the charts and in source notes 8 and 18. Publication dates, financial periods and milestones in service availability are distinguished. Awarded contracts, recognised expenses and capital expenditure retain their respective boundaries, with no aggregate cost reconstructed across victims. No interviews or requests for comment were conducted for this edition.

The notes below identify the documents actually consulted, their locators and their limitations. Calculation formulas appear on this page; third-party originals remain available from their publishers.

Further reading

The sixth instalment, on shared providers, follows the interruptions at CDK and Synnovis into their customers’ operations.

The fourth instalment on JLR’s footprint in GDP distinguishes output, financial losses and the work of recovery. The investigation of cyber insurance follows the passage from a loss to compensation. The glossary explains minimum viable operations, incident response retainers and service availability.

Sources

Numbered references link to the documents below. Accessed: 19 October 2026.

1. [1] British Library · Learning lessons from the cyber-attack: British Library cyber incident review · 2024-03-08. PDF pp.2 and 4: preserved copies, unavailable infrastructure and NCC engagement; pp.9, 12–16: software, parallel phases, renewal planned from 2022 and intended architecture. The Library explains why safe copies were insufficient to restart its services and sets out its Rebuild & Renew programme. The affected institution’s own review. Architecture and durations were intentions stated in March 2024; phases were planned to run concurrently. NCC fees are not disclosed.
2. [2] British Library / GOV.UK · Annual Report and Accounts 2023–2024 · 2024-07-29. Printed pp.34, 38 and 45 (PDF pp.35, 39 and 46): accelerated budgets, intended timetable and additional costs at 31 March 2024. The report distinguishes £0.6m of directly additional costs from accelerated digital spending already planned; it then envisages rebuilding work through July 2025. A narrow amount at the first year-end after the attack. Deferred activity and budget underspends do not measure an economic gain. July 2025 was a target.
3. [3] British Library / GOV.UK · Annual Report and Accounts 2025–2026 · 2026-07-15. Printed pp.4, 7, 11, 33–34, 43 and 76 (PDF pp.6, 9, 13, 35–36, 45 and 78). The report describes the platform launched in December 2025, services restored in stages and £4.2m of technology capital expenditure versus £0.7m the previous year. The investment category extends beyond the attack’s incremental cost. The narrative includes developments after 31 March 2026; the catalogue’s return does not establish recovery of every service.
4. [4] British Library · EThOS platform restored · 2026-07-08. How to use EThOS; FAQ on metadata, university links, full-text availability and update frequency. EThOS returns with over 650,000 records; almost 65% link to university repositories. The platform also describes its workflows and update backlog. Page content and figures were verified on 19 October 2026; 8 July is its publication date. Bibliographic records and links are distinct from locally hosted full-text files. The percentage is rounded; access depends on the destination repository. Any later page revision is undated.
5. [5] Marks and Spencer Group plc ; independent report by Deloitte LLP · Annual Report and Financial Statements 2026 · 2026-06-01. Independent auditor’s report, printed pp.101–102 and 104 (PDF pp.103–104 and 106); note 5 p.132 (PDF p.134). Deloitte describes manual processes, additional audit work, supplier reconciliations and testing of costs directly attributable to the incident. Independent financial audit using sampling, with its thresholds and limitations. No material misstatement due to the incident was identified; this does not certify every technical invoice.
6. [6] Jaguar Land Rover Automotive plc ; independent report by KPMG LLP · JLR Annual Report FY25/26 · 2026-05-21. Note 4, printed p.177 (PDF p.89, right-hand page); audit printed pp.155–156 (PDF pp.78–79); GRI index for publication date. GRI 2-3, printed p.240 (PDF p.121 left): stated publication date 21 May 2026. JLR classifies £260m of cyber-related charges as exceptional, including third-party obligations and professional fees, and explains what remains in underlying results. An expense perimeter, distinct from total payments to specialists or economic loss. The £58m in other expenses and £202m in cost of sales do not break down professional fees. The 16 July path and VersionId parameter identify the consulted version.
7. [7] Jaguar Land Rover Automotive plc · JLR Q1 FY27 interim financial statements / narrative reporting · 2026-08-13. PDF p.9, Risks and mitigating factors; p.18, note 4; supplementary release dated 13 August 2026. The report published in August describes investigation, recovery and remediation as ongoing; no exceptional items are recognised for April–June. The statement appears in an August publication, while the accounts cover the quarter ended in June. Zero exceptional items does not mean zero recovery spending.
8. [8] NCC Group / UK Digital Marketplace · G-Cloud 14 : Pricing Document, Cyber Incident Response · G-Cloud 14; first publication date unestablished. PDF p.2, prices and minimum prepaid days; p.3, scope, GBP excluding VAT and out-of-hours uplift. The rate card combines an annual availability fee with prepaid days; Bronze lists £9,500 plus at least three days at £2,200. Calculations in pounds excluding VAT: 9,500 + 3 × 2,200 = 16,100; 2 × 2,200 = 4,400. A minimum commitment and an increased day rate, without a bill ceiling or observed expenditure at a victim organisation. Catalogue pricing, without a signed customer contract or attribution to a victim. Exact first publication is unknown; the document is linked to G-Cloud 14. The calculated £16,100 excluding VAT is not a billing cap.
9. [9] NCC Group / UK Digital Marketplace · NCC Group Terms and Conditions for the Supply of Services (UK) · G-Cloud 14; first publication date unestablished. Retained Incident Response module, PDF pp.12–15: definitions, clause 5.9, clauses 8.2–8.6 and Appendix 1. The template distinguishes availability fees, prepaid hours, limited reallocation of remaining hours and a capacity caveat for exceptional demand. Printed effective date of 1 February 2022; first publication unknown. Template terms are subject to the customer contract. No activation of the surge clause or actual recovery time is established. The terms state an effective date of 1 February 2022; their initial publication date remains unestablished.
10. [10] NCC Group / UK Digital Marketplace · G-Cloud 14 : Retained Cyber Emergency Incident Response, service definition · G-Cloud 14; first publication date unestablished. PDF p.2, specialist access and potential services; p.3, scoping, onboarding, standby, response and close-down. NCC describes a service prepared before the crisis, access to specialists and close-down work after the response. A commercial description; access to legal or crisis specialists does not establish that all their work is included in the base fee. Independent effectiveness is not measured.
11. [11] UK National Cyber Security Centre · Recovering from a highly disruptive cyber attack : 1. Immediate activities · 2026-07-28. Sections 1.1–1.2: governance and investigation; 1.4: priorities, dependencies and backups; 1.5–1.8: obligations and communications. NCSC recommends informing restoration with analysis of the compromise, business dependencies and the organisation’s obligations. General institutional guidance; it does not describe the work actually carried out at JLR, M&S or the British Library. Page reviewed on 1 October 2026.
12. [12] UK National Cyber Security Centre · Recovering from a highly disruptive cyber attack : 2. Recovery and ongoing investigations · 2026-07-28. Sections 2.1 and 2.2.1–2.2.3: minimum viable operations, investigation, business functions and dependencies; 2.2.8–2.2.10: legal, HR and procurement. The guidance organises recovery into parallel workstreams and describes assurances third parties may seek before reconnecting. A decision framework, without a statistical average duration or guaranteed outcome. Third-party requirements are a stated possibility, not a measured cause of any victim’s delays. Page reviewed on 1 October 2026.
13. [13] UK National Cyber Security Centre · Recovering from a highly disruptive cyber attack : 3. Rebuild · 2026-07-28. Introduction; sections 3.2–3.2.1 on improvements and ongoing funding; 3.3 on data reconciliation. A durable rebuild goes beyond minimum operations and requires reconciling backups with data created through temporary processes. NCSC warns that an overly broad transformation can burden recovery. The framework does not allocate actual spending between repair and modernisation. Page reviewed on 1 October 2026.
14. [14] UK National Cyber Security Centre, with ABI, BIBA and IUA · Guidance for organisations considering payment in ransomware incidents · 2024-05-14. Consult experts; Assess the impact; Investigate the root cause; discussion of decryption-tool and backup timescales. The guidance places any negotiation within a broader decision and explains that a decryptor can take time across a complex network. Backups may sometimes be faster; no universal ranking or ransom payment by the cases examined is inferred. The guidance prices no individual engagement.
15. [15] British Library / Find a Tender, Cabinet Office · 002434 British Library Web Foundations Project : award notice 038013-2024 · 2024-11-25. Notice 038013-2024, II.1.7 and II.2; official JSON: contracts[0].value/dateSigned, tender.lots[0].description, awards[0].suppliers; supplementary Contracts Finder JSON. The £396,908 award to Q42 replaces the interim website and prepares later integrations, within a workstream begun before the attack. Contract value, distinct from payments and the attack’s incremental cost. The same award appears in two registers. An isolated “cancelled” lot field conflicts with active award and contract statuses. Official contract data.
16. [16] British Library / Contracts Finder · Supply of Library Management Systems & Associated Services : award 002498 · 2024-12-11. Published-notice JSON: notice.description/publishedDate; awards[0].value, supplierName, awardedDate, startDate and endDate. The notice awards Ex Libris (UK) Limited the supply and implementation of Alma, Primo and Rapido for £2,659,973. The JSON does not explicitly state the VAT basis. Award value, without a payment schedule or repair/licensing/modernisation breakdown; the platform programme predated the attack. Official award data.
17. [17] Bank of England · Growth and regulation : speech by Andrew Bailey · 2026-07-14. Final part of the speech, on frontier AI: coordinated testing and the paragraph introducing bare-metal recovery. At Mansion House, Andrew Bailey calls for stronger capabilities to rebuild systems to a fully operational state. A position expressed in a speech, without a new legal obligation or a quantified rebuilding budget. It does not establish the preparedness of the three victims examined.
18. [18] Marks and Spencer Group plc · Full Year Results for the 52 Weeks Ended 28 March 2026 · 2026-05-20. PDF p.20 and note 3 p.37: £131.3m direct costs including £109.3m for systems; p.19 and note 2 p.34: insurance. M&S details immediate systems response and recovery, followed by third-party costs chiefly for legal and professional services. The £22m residual is calculated by subtraction. Calculations, in millions of pounds: 131.3 − 109.3 = 22.0; 109.3 ÷ 131.3 × 100 = 83.244…%, rounded to 83.2%. The ratio concerns only M&S’s recognised direct costs for these 52 weeks. Recognised expenses, distinct from cash payments. £22m is not exclusively lawyers’ fees, nor £109.3m exclusively external consultants. The £100m insurance income covers a different perimeter.

Original text and illustrations: l0g · CC BY 4.0. Cited documents retain their publishers’ rights.