PYMNTS.com August 27, 2025
When the British retailer Marks & Spencer (M&S) disclosed last year that a supplier breach had unleashed a ransomware attack, it was the kind of nightmare scenario every corporate board dreads.
The incident disrupted logistics, erased more than 750 million pounds (approximately $1 billion) in market value in a matter of days and left executives fending off questions about why third-party controls hadn’t caught the risk. More so, the event was a stark reminder of a hard truth: sometimes, the weakest link in a company’s cybersecurity defenses isn’t the company itself, but a trusted vendor.
Data from PYMNTS Intelligence in the August edition of The 2025 Certainty Project report, “Vendors and Vulnerabilities: The Cyberattack Squeeze on Mid-Market Firms,” reveals that...







