Digital Audit - Marks & Spencer Group plc

Domain: Digital - Digital / Technology Entity scope: Marks & Spencer Group plc (LSE: MKS), London. M&S-corporate’s OWN technology procurement is in scope; Ocado-JV platform technology is flagged as JV-partner (Ocado Group-owned). Vendor-domicile rule applies: only genuinely Israeli-domiciled vendors counted in scope. Compiled: 2026-06-21 Method: Live web search only

Enterprise Technology Stack & Vendor Relationships

Core cloud and data infrastructure - Microsoft Azure (M&S-own). M&S operates a substantial Microsoft Azure estate. Published Microsoft customer-story documentation confirms deployment of Azure Data Lake Storage, Azure Databricks, Azure Synapse Analytics, and Power BI for analytics and data-science workloads.¹ A separate Microsoft case study confirms Azure Machine Learning is used to scale and train hundreds of customer-loyalty (Sparks) models in parallel.² In March 2026 M&S announced the rollout of 11,000 Microsoft 365 Copilot licences to store managers and Store Support Centre colleagues.³ No Israeli nexus: Microsoft Azure is US-domiciled.

Syte - Israeli-domiciled visual-AI vendor (M&S-own). M&S deployed Syte’s visual-search product (“Style Finder”) on its mobile site in January 2019, allowing shoppers to photograph an item and surface visually similar M&S products.⁴ Syte was founded in Tel Aviv in 2015 and its principal R&D and corporate operations remain Israel-domiciled.⁵ M&S is the customer procuring a retail-facing SaaS product; no evidence of M&S supplying technology or data to Syte for any Israeli governmental or military purpose. Current contractual status (post-2023) is unconfirmed in public sources; the relationship should be treated as active until M&S formally confirms otherwise.

Global-e - Israeli-domiciled cross-border e-commerce platform (M&S-own). M&S uses Global-e (Nasdaq: GLBE) for its cross-border international e-commerce localisation, a relationship extended in 2019.⁶ Global-e was founded in 2013 by three Israeli entrepreneurs and is headquartered at 25 Bazel St., Petah Tikva, Israel.⁷ M&S is a merchant customer using the platform for pricing, duties, and checkout localisation on international online storefronts; no evidence of any defence or governmental nexus.

Namogoo - Israeli-domiciled client-journey protection vendor (M&S-own). M&S selected Namogoo (Herzliya, Israel) in January 2021 to protect M&S.com visitors from unauthorised third-party injected advertisements.⁸⁹ Namogoo was founded in 2014 and raised $40 million in Series C funding; the company was subsequently acquired by French firm AB Tasty in November 2025, at which point Namogoo’s Israeli operation became a subsidiary rather than an independent vendor.¹⁰ M&S’s continued post-acquisition status with AB Tasty/Namogoo is not confirmed in public sources.

Optimove - no verified M&S relationship. Optimove (Tel Aviv-founded Israeli CRM/marketing platform) was investigated as a candidate given M&S’s published CRM investments. No public evidence of a Marks & Spencer–Optimove deployment was identified. M&S’s confirmed Customer Data Platform is mParticle (US-domiciled).¹¹ Claim of Optimove deployment: No public evidence identified.

Other confirmed vendors (non-Israeli). mParticle (US, CDP);¹¹ Google Cloud / Dialogflow contact-centre AI implemented via partner Sabio Group;¹² SymphonyAI Retail CPG (US, store-intelligence computer vision in 500+ stores);¹³ First Insight (US, Pittsburgh, merchandise-intelligence AI since 2015, expanded December 2024);¹⁴ Thread IP (UK-founded fashion-personalisation, acquired November 2022);¹⁵ Hitachi Data Systems (Japan, storage migration);¹⁶ and TCS (India, IT helpdesk - contract terminated late 2025, see below).¹⁷ None carry an Israeli nexus.

Ocado Retail JV - M&S Food online (JV-partner technology, NOT M&S-own). M&S holds a 50% share in Ocado Retail Ltd, a joint venture with Ocado Group established in 2019 for £750 million. The JV operates the online M&S Food grocery business on the Ocado Smart Platform (OSP).¹⁸ The OSP and its technology are owned and operated by Ocado Group plc (UK-domiciled, LSE: OCDO), not by M&S. Any Israeli technology nexus attributable to Ocado’s platform belongs to Ocado Group’s audit, not M&S’s. Flagged here as JV-partner technology for disclosure completeness; M&S is not the technology owner or controller of OSP.

Surveillance, Biometrics & Retail Technology

M&S partnered with FOUR Security Consultants to obtain the UK Surveillance Camera Commissioner’s certification, becoming the first UK retailer to achieve it, indicating it operates CCTV systems subject to the Surveillance Camera Code of Practice; the vendor is UK-domiciled, with no Israeli nexus identified.¹⁹

M&S chairman Archie Norman publicly stated the company has opted against facial recognition in stores, preferring to limit shelf stock as a shrinkage deterrent.²⁰ No public evidence identified of M&S deploying Israeli facial-recognition or biometric-surveillance technology in any retail environment.

M&S Bank (a separate financial-services entity operated in partnership with HSBC) offers optional fingerprint and facial-recognition login via its mobile app - consumer-facing biometric authentication for a banking product, not in-store surveillance; the biometric SDK vendor is not confirmed in public sources, and no Israeli nexus is identified in available evidence.²¹

SymphonyAI’s AI/computer-vision system on handheld devices in 500+ stores checks shelf compliance against planograms; this is retail operational computer vision, not customer tracking or facial recognition, and SymphonyAI is US-domiciled.¹³

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

M&S’s primary cloud infrastructure is Microsoft Azure, used for data lakes, analytics, machine learning, and e-commerce workloads.¹² No public evidence of M&S data being routed through or stored in Microsoft’s Israeli data-centre infrastructure. M&S procures cloud rather than providing it, and does not appear on any published list of participants in UK government sovereign-cloud initiatives in a technology-vendor capacity. An earlier infrastructure migration moved M&S on-premises storage to Hitachi VSP systems (Japan-domiciled vendor).¹⁶ The April 2025 cyberattack exposed approximately 10 million customer records (names, addresses, email addresses), per M&S’s customer notification; data-residency architecture at the time of the breach was not detailed in public disclosures.²²

Defence, Intelligence & Security Sector Technology Relationships

No public evidence was identified of M&S Group plc holding contracts with any Israeli defence prime, intelligence agency, or Unit 8200–affiliated cybersecurity company. No public evidence identified.

2025 ransomware cyberattack - Scattered Spider / DragonForce (not Israeli). In April 2025 M&S suffered a major ransomware attack:

• Threat actor: Scattered Spider (also tracked as UNC3944), a loosely affiliated English-speaking cybercrime collective - not an Israeli group.²³
• Ransomware strain: DragonForce, deployed on M&S VMware ESXi servers, encrypting virtual machines powering e-commerce, payment processing, and logistics.²⁴
• Attack vector: Social engineering via M&S’s IT helpdesk (operated by TCS); attackers impersonated an M&S employee to obtain a password reset, then exfiltrated the Windows domain controller’s NTDS.dit file and cracked credentials offline.²⁵
• Arrests: Four individuals (three UK citizens and one Latvian national, aged 17–20) were arrested on 10 July 2025; total estimated losses across M&S, Co-op, and Harrods reached approximately £440 million.²⁶
• Financial impact on M&S: Approximately £300 million reduction in annual profit; multi-day suspension of online clothing sales; a substantial drop in market capitalisation.²⁷
• ICO regulatory action: M&S received a £20 million fine from the UK Information Commissioner’s Office for data-protection failures arising from the attack.²⁸
• TCS contract termination: M&S terminated its long-running IT helpdesk contract with TCS in late 2025 following the breach.¹⁷

No Israeli cybersecurity firm has been identified in public sources as involved in either the attack or the remediation.

AI, Algorithmic & Autonomous Systems

M&S’s AI footprint is predominantly US-vendor and in-house: Microsoft 365 Copilot (11,000 licences, March 2026);³ Thread IP personalisation algorithms generating recommendations across 40+ million fashion combinations (UK-founded, in-house since the 2022 acquisition);¹⁵ Azure Machine Learning for the Sparks loyalty programme;² SymphonyAI computer vision (US);¹³ and First Insight Voice-of-the-Customer AI (US).¹⁴ M&S is also investing £340 million in an automated National Distribution Centre in Northamptonshire using AI and advanced robotics; the robotics/AI technology partner is not confirmed in public sources, and no Israeli nexus is identified in available evidence.²⁹ M&S has additionally announced an internal data-science and AI academy to build in-house capability.³⁰ No public evidence identifies an Israeli-domiciled AI vendor in M&S’s AI stack.

Technology Ecosystem & R&D Footprint

M&S operates a retail-tech startup engagement programme; a 2019 corporate blog post confirmed Syte as one of several startups selected for digital-innovation pilots - the documented channel through which the Syte visual-search deployment originated.³¹ Following the Thread acquisition, M&S established a “personalised discovery team” within its data-and-digital function, employing former Thread engineers and data scientists.¹⁵ No public evidence was identified of M&S maintaining any R&D facility, innovation hub, or formal research partnership with an Israeli university, government body, or technology incubator. No public evidence identified.

Civil Society Scrutiny & Regulatory History

M&S has documented historical leadership links to Zionist advocacy (former chairman Marcus Sieff served as vice-president of the British Zionist Federation). These are matters of corporate history and political affiliation, not digital-technology complicity; they are noted for completeness but belong in Political.

As of late-2025 ethical-retail assessments and the BDS National Committee’s guidance, M&S is not subject to an active BDS technology-specific boycott campaign; historical campaigns related to M&S’s Israeli franchise operations and food sourcing have not extended to a technology-platform boycott.³² Separately, UK pro-Israel advocacy body CUFI published a piece celebrating M&S’s partnerships with Israeli startups Syte and Namogoo as examples of UK–Israel commercial collaboration - a framing from a pro-Israel advocacy source that does not alter the factual vendor relationships described above.³³

M&S received a £20 million ICO fine for data-protection failures arising from the April 2025 ransomware attack, which exposed approximately 10 million customer records - its principal digital-domain regulatory sanction on record.²⁸ M&S gave evidence to the UK Parliament Business and Trade Sub-Committee on Economic Security on 8 July 2025 regarding the attack; no Israeli technology nexus arose in the published evidence session.³⁴

End Notes