TCS Refutes Claims about Marks & Spencer Contract Loss

Moneylife Digital Team 27 October 2025

Economy & Nation

Tata Consultancy Services (TCS) has firmly rejected a recent report published by The Telegraph in the UK that suggested the Indian information technology giant lost a substantial contract with British retailer Marks & Spencer (M&S) due to failures related to a cyberattack. The company has characterised the article as containing misleading information and factual errors.

The Telegraph article titled "M&S ousts Indian outsourcer accused of £300m cyberattack failures", which appeared on 26 October 2025, alleged that M&S had terminated its relationship with TCS following a cyberattack that reportedly cost the retailer approximately £300mn (million). However, in a regulatory filing TCS highlighted significant inaccuracies in the report by the newspaper.

According to TCS, the service desk contract referenced in the media report was subject to a standard competitive bidding process that commenced in January 2025. It says M&S made its decision to work with alternative partners well before the cyber incident occurred in April 2025, making the two matters entirely separate and unrelated. This timeline, it says, is crucial to understanding that the contract change was a routine business decision rather than a consequence of the cyberattack.

TCS also claimed that the article contained inaccuracies regarding both the size of the agreement and the nature of its ongoing relationship with the British retailer and that the service desk contract represents only a minor portion of its comprehensive engagement with M&S.

TCS states that it continues to collaborate with M&S across numerous other projects and domains, expressing pride in its enduring strategic partnership with the retailer.

The Tata group company also provided a technical clarification regarding the cyberattack. It says it performed thorough scans of its own networks and systems following the incident and determined that the vulnerabilities exploited in the attack did not originate from TCS infrastructure. Furthermore, it says that it does not provide cybersecurity services to M&S, as those are handled by a different partner organisation.

The cyberattack on M&S, disclosed in April, was characterised as highly sophisticated and targeted. The incident was expected to result in about £300mn in lost operating profit for the British company, with online services anticipated to face disruptions extending into July.

In April 2023, TCS secured a significant contract valued at around US$1bn to modernise M&S’s legacy technology systems, particularly focusing on supply chain operations and omni-channel sales capabilities. This broader engagement continues despite the conclusion of the service desk contract.

The incident highlights the complexity of large-scale IT service relationships and the importance of accurate reporting when covering corporate partnerships and cybersecurity matters.

Both TCS and M&S have aligned in their statements confirming that the service desk contract change followed standard procurement procedures and was unrelated to the subsequent cyberattack, despite the unfortunate timing that may have created an appearance of connection between the two events.

Comments