Cyber Incident Update.

MARKS AND SPENCER GROUP PLC

CYBER INCIDENT UPDATE

Marks and Spencer Group plc (the Company, or M&S) has been managing a cyber incident over the past few days.

As soon as we became aware of the incident, it was necessary to make some minor, temporary changes to our store operations to protect customers and the business and we are sorry for any inconvenience experienced. Importantly, our stores remain open and our website and app are operating as normal.

The Company has engaged external cyber security experts to assist with investigating and managing the incident. We are taking actions to further protect our network and ensure we can continue to maintain customer service.

In parallel, the Company has reported the incident to the relevant data protection supervisory authorities and the National Cyber Security Centre.

Customer trust is incredibly important to us, and if the situation changes an update will be provided as appropriate.

M&S' financial year ended on 29 March 2025, with full year results scheduled to be announced on 21 May 2025.

-Ends-

For more information, please call:

Investor Relations: Fraser Ramzan: +44 (0)7554 227 758

Corporate Press Office: +44 (0)20 8718 1919