TCS refutes UK media report on losing $1-billion M&S contract over cyberattack

TCS says it continues to work on numerous other areas, in its role as a strategic partner for M&S and is proud of the longstanding partnership with the UK firm.

Tata Consultancy Services Ltd. has denied a report published in The Telegraph UK that Marks & Spencer's Plc has scrapped its contract with India's largest outsourcer over a cyberattack that affected the UK-based earlier this year.

TCS has a $1-billion contract with Marks & Spencer's. (Reuters)

“The report published…is misleading, with factual inaccuracies including the size of contract and the continuity of of TCS' work for M&S,” according to an exchange filing in Mumbai on Monday (27 October 2025). Moreover, M&S initiated a “request for proposal” process for its service-desk contract in January 2025, much before the cyberattack happened in April 2025.

“These matters are hence clearly unrelated,” TCS went on to say.

On 26 October, The Telegraph UK reported that M&S has ditched TCS accused of “being at fault for its devastating cyberattack earlier this year”. The report pegged the size of the contract £300 million as against £1 billion reported in the Indian media earlier. The retailer has not renewed a deal with TCS to run its tech helpdesk, the report stated.

As for the cyberattack, TCS said the related vulnerabilities did not originate from the systems it operates for M&S. “TCS does not provide cybersecurity services to M&S. This is a services that is provided by another partner.”