Company
British multinational retailer selling clothing, home goods, and food through stores and online across the UK and internationally.
M&S and John Lewis bosses are pressing Chancellor John Healey to cut retail's tax burden, with the Budget less than three weeks away. Most of what they want is protection from new charges, so their campaign is a fight to stop retail bills rising further.
Reality
Asos said hackers obtained an employee's login by posing as a trusted contact, then reached customer names and contact details on third-party platforms. The shares fell on the hackers' app alert two days before Asos explained it. For a board, that puts staff checks and disclosure speed inside the same risk.
Reality
A joint CISA and FBI advisory says the group rehearses a company's password-reset process over several calls before it asks for anything. That puts factor-reset workflows in the identity boundary, not the support queue.
Reality
Verizon's 2026 DBIR puts mobile phishing simulation click rates 40% above email. Most of those attempts never reach a security team, because the report button, the gateway and the triage queue all sit in the inbox.
Reality
The first critical third parties have been designated, putting technology, data and operations suppliers under direct UK supervision. Firm-level responsibility does not move an inch.
Reality
A July 2026 joint alert on North Korean IT workers and the 2025 M&S breach sit at opposite ends of the identity lifecycle: hiring and recovery. Neither required breaking authentication.
Reality