Marks and Spencer (M&S) is expected to file a cyber insurance claim worth up to £100m following its recent data breach.

Sources familiar with the matter told the Financial Times that the supermarket’s cyber insurance policy, arranged by WTW, allows for a £100m claim, covering both first-party and third-party losses.

Insurance giant Allianz is said to be first in line to cover up to £10m, with Beazley also exposed to the losses. All parties, including M&S, Allianz and Beazley have declined to comment.

Market insiders believe the full value of the policy may be payable, even if the breach stemmed from vulnerabilities linked to a third-party vendor.

Subscribe to Grocery Gazette for free

Sign up here to get the latest grocery and food news each morning

Despite customer data protections, the attack has had significant commercial consequences, with industry experts suggesting M&S may have already lost over £60m in online sales based on average digital revenue.

Sources also warned that the retailer’s annual cyber premium – currently under £5m – could double upon renewal if M&S does not demonstrate improved risk management practices.

The recent update came as M&S entered the fourth week of its ongoing cyber crisis.

Yesterday (13 May), M&S revealed that personal customer data had been stolen in the attack, including contact information, dates of birth and online order histories.

M&S operations director Jayne Wall, issued a statement warning customers that “You might receive emails, calls or texts claiming to be from M&S when they are not, so do be cautious.”

Yet the retailer has also reassured shoppers that they do “not need to take action”, and that its online users have only been prompted to change their password for “peace of mind”.

The statement added: “We have said to customers that there is no need to take any action. For extra peace of mind, they will be prompted to reset their password the next time they visit or log onto their M&S account, and we have shared information on how to stay safe online.”