UK companies should have to disclose major cyberattacks, M&S says

British businesses should be legally required to report material cyberattacks to the authorities, the chairman of retailer Marks & Spencer said on Tuesday, claiming two recent major attacks on large UK firms had gone unreported.

Giving evidence to lawmakers on parliament’s Business and Trade Committee on the April cyberattack which forced M&S to suspend online shopping for nearly seven weeks, Archie Norman said the group had learnt that “quite a large number” of serious cyberattacks never get reported to the National Cyber Security Centre (NCSC).

“In…