M&S supplier resorts to pen and paper after cyber attack

One of Marks & Spencer's biggest suppliers has resorted to using pen and paper for orders as the disruption from the cyber attack on the retailer continues.

The boss of Greencore, which supplies sandwiches, rolls and wraps, says it has also ramped up deliveries by a fifth to make sure there is more than enough food for the bank holiday weekend.

M&S has been unable to offer online orders for clothing and homewares for over a week, and some stores have seen empty shelves as food deliveries have also been disrupted.

Two M&S workers told the BBC they were concerned about pay because they were unable to clock in and out of work and could not access staff apps.

In a glimpse into the behind-the-scenes situation at M&S, Greencore chief executive Dalton Philips said: "In the absence of having all the systems speaking to each other, you revert to how it was 25 years ago."

That means back to "pen and paper", he said.

Greencore has also been putting on additional shifts at its dedicated M&S factory in Northampton, putting more lorries on the road, and is sending more food to stores than they did over Christmas.

"They're a massive customer for us and we're trying to flood them with products to help them," said Mr Philips.

"There are times when you do need to revert to manual systems in any business... but look, it works well.

"With the challenges of the system we don't have intricate forecasting that we would have previously had, so we're just making sure that they've got everything they need and some more."

George, not his real name, works at an M&S in Wales, and said it has been "a nightmare".

"We have been told pay will be given through a separate payment system. However, we have not been told whether the pay will be correct.

"Additionally, there have been back-and-forth instructions, which have changed hourly. For example: remove gift cards from shop floor, put them back (when working)."

Jeannette Pellen, 76, in Doncaster who retired from her role as an M&S customer assistant in a Scunthorpe store at the end of April, said they had been unable to clock in and out of work as a result of the attack.

"There is no way of receiving advice via managers or the outsourced HR," she told the BBC.

M&S has reassured staff that they will be paid for all contracted hours as usual.

As a former chief executive of the supermarket chain Morrisons, Mr Philips knows only too well the pressure M&S bosses are under.

"They will be literally working 24/7. You've got to work your way through it. Whenever I've spoken to the team this week, it's been really impressive how calm and focused they are.

"I think if you work in retail, you know people are often the most on their game and motivated at those periods of intense pressure."

Greencore has also sent a handful of its own staff to key M&S stores in London to provide extra support.

M&S hasn't released details on how its systems have been affected, saying only that some have been temporarily taken offline leading to pockets of limited availability in stores.

One food industry veteran who knows the business well thinks M&S will be focusing on making sure it can still provide all of its best-selling items.

"The issue is, if you've got 7,000 products, then obviously that's a lot of data to review."

But he also pointed out that for big seasonal events there will be a lot of buying in advance and the company will have historical back-ups. Suppliers will also have a view on what will sell well.

Ged Futter, a former buyer for Asda who now runs his own consultancy advising suppliers, says M&S is in a difficult situation, but believes it will find a way round it as retailers are very good at finding solutions.

"If they have to, they'll use a fax machine. Any silo mentality disappears and everyone becomes very clearly focused on how to fix it."

But the longer this goes on, the risk of damage to M&S's reputation and to its customer loyalty increases.

The company has been praised for its communications with customers, but has kept quiet on the nature of the attack and how it unfolded. That may not be sustainable for much longer.

The chair of the Business and Trade Select Committee, Liam Byrne, has written to M&S chief executive Stuart Machin seeking reassurances, saying it was "imperative" to understand what had happened.

One person, who is a former chief executive at another firm and had to deal with a data breach, told the BBC the advice from his PR adviser was simple.

"Say nothing until you know everything. Then say everything. Then say nothing."

M&S has been contacted for comment.