It's embarrassing, it's expensive, and it's not over. But the company should pull through

Shouldn't a robust IT system be able to withstand the odd "human error", such as somebody at a third-party supplier being hoodwinked by devious cybercriminals?

- Nils Pratley

Isn't £300m at the expensive end for events of this kind? And should it really take four and a half weeks, and counting, for one of the UK's biggest and most well-resourced retailers to restore its website to working order?

The response of Marks & Spencer's chief executive, Stuart Machin, to such questions ran along these lines: the incident had nothing to do with underinvestment in IT; everyone is vulnerable; M&S was unlucky; the "moment in time" will pass and everything will be back to normal by July at the latest.

Too complacent? Is the M&S boss marking his own homework? Well, before joining the chorus that says M&S should have been better prepared, one should probably say that assessing corporate responses to these cyber-attacks is impossible from the outside. M&S can't share the full details of what happened, just as no other company that is hacked ever does.