The ransomware attack, briefly
In late April 2025, Marks & Spencer’s IT systems were taken out by a ransomware attack. Online orders went down. Inventory management went down. The internal supply chain went down. For roughly two months, M&S was running its food halls on manual workarounds and paper-based stock control, which is not how a modern supermarket is supposed to work.
The financial damage was very real. Around three hundred million pounds in lost operating profit, according to the public estimates. Among the costliest retail cyber-attacks in British history.
The Tesco intervention
The interesting bit, and the bit that surprised the retail trade press, was Tesco’s response. Tesco’s wholesale arm, Booker, started delivering essential branded products into M&S stores to keep the shelves stocked while M&S got its systems back up. Two products were specifically called out as priority items in the trade press: Coca-Cola and Marmite.
Tesco’s CEO Ken Murphy described it as a “short-term emergency measure”. Which, fair enough, but it is also unusual. Tesco and M&S are competitors. Booker is set up to supply convenience stores and independents, not the food hall of the rival down the road. The fact that the arrangement happened at all, and happened quickly enough to keep stock on M&S shelves, says something about how the British retail sector quietly cooperates when one of its members is down.
Why Marmite specifically
This is the bit fans of the jar will quietly enjoy. Marmite was deemed essential enough to ship across enemy lines.
There were probably twenty product lines on the priority list, and we only saw the headline ones. But the headline ones are revealing. Coca-Cola makes obvious sense, because it is the single most-sold branded soft drink in the country and an empty Coca-Cola shelf gets noticed within minutes. Marmite is more interesting. It is not the highest-volume product in the food hall by any stretch. What it is, is a product that loyal shoppers will quietly cross to a different supermarket for if their usual stockist runs out.
That is the threat. Marmite shoppers are not casual. If you go to M&S for your Marmite and it is not there, you do not switch to a different spread. You go to Sainsbury’s. The Tesco-via-Booker shipment was protecting against exactly that kind of customer drift.
What this tells us about the brand
Three things, briefly.
First, the trade view of Marmite is consistent with the consumer view. It is small but loyal. The volume is modest, but the user attachment per unit volume is unusually high. That is the kind of brand position you want.
Second, Marmite has the kind of distribution footprint where the question “will Tesco supply Marmite to M&S?” actually had a workable answer, because the supply chain behind the jar is fundamentally one and the same. Unilever sells to both. Booker can pull from the same warehouse that supplies independents. The product moved through existing pipes.
Third, and a little more speculatively, the fact that the press wrote up the Marmite angle as the story is itself a brand asset. Coca-Cola has bigger problems than getting Marmite-style human-interest coverage out of a ransomware response. Marmite gets to be the underdog hero of a story about retail resilience. That is the sort of thing the marketing department gets for free.
A small note on the broader point
The M&S attack is also a quiet reminder that modern supermarket supply chains are more fragile than they look. Just-in-time logistics is wonderful until somebody encrypts the database. The Marmite-on-Tesco-trucks-into-M&S story is a small piece of a much larger story about cyber risk in retail that the sector is, mercifully, taking more seriously than it did this time last year.
M&S are mostly recovered now. Marmite is back through their normal supply chains. The Tesco arrangement was, as Murphy said, short-term emergency. But the next time someone tells you Marmite is “just a spread”, remember that when British retail had to choose what was essential enough to truck through an emergency, the jar made the list.
Source: trade press, May to June 2025; Tesco public statements; M&S earnings disclosure.
