M&S technology chief quits less than one year after cyber attack

Share

Marks & Spencer’s chief technology officer, Josie Smith, is stepping down just 18 months after joining the retailer and less than a year after a devastating cyber attack crippled the company’s operations.

The departure, disclosed in an internal memo this week, marks the second high-profile exit from M&S’s technology leadership in recent months. Rachel Higham, the company’s chief digital and technology officer, left the business in September 2025.

Darren Gibson, currently the technology transformation director for fashion, home, and beauty, has been named as Smith’s successor.

The management shake-up follows a turbulent year for the British retail giant. In April 2025, a ransomware attack attributed to the hacking collective “Scattered Spider” forced M&S to suspend online sales for several weeks.

The breach, which originated through a third-party IT contractor, hit the company’s bottom line hard, with M&S reporting an estimated £300 million loss in operating profit for the 2025/26 financial year.

The “long tail” effects of the hack were still evident in the company’s recent performance. Earlier this month, M&S reported a decline in like-for-like clothing sales during the critical Christmas trading period, attributing the slump in part to the lingering operational disruption caused by the April breach.

At the height of the crisis, stores were forced to revert to “pen and paper” systems to track fresh food and clothing deliveries.

“Josie Smith has decided to leave M&S,” the internal memo stated, thanking her for her contributions. Smith, a veteran of BT Group and Vodafone, had been tasked with overseeing the retailer’s complex technology infrastructure during one of the most challenging periods in its history.

The leadership exodus extends beyond the technology department. The same memo confirmed that Krista Nordlund, the chief product officer who joined in late 2021 to improve digital touchpoints, will also leave the company in July to return to the United States.

Despite the departures, M&S leadership remains publicly optimistic. Chief Executive Stuart Machin previously described the cyber attack as a “bump in the road,” asserting that the crisis would allow the retailer to “accelerate the pace of improvement” in its ongoing technology transformation.

Gibson will now take the lead on that mission as the company attempts to bolster its defences against future threats.

For latest tech stories go to TechDigest.tv