The Cyber Monitoring Centre (CMC) considers the recent cyberattacks on M&S and Co-op as a single combined event by the attacker named Scattered Spider.
The attacks are estimated to have a financial impact of between £270 million to £440 million on both firms.
The disruption costs are mainly driven by business disruption, impacting not just the retailers but also their suppliers and partners.
M&S and Co-op faced business disruption, data loss, and incurred costs for incident response and IT rebuild.
The wider cost analysis includes the impacts on partners, suppliers, and other entities.
The attack on Harrods, another major UK retailer, has not been included due to insufficient information about the cause and impact.
M&S reported the attack on April 22 which may cost them around £300 million in lost operating profit.
M&S has not confirmed paying a ransom to the hackers but admitted some customer data was stolen, excluding sensitive payment details.
Customers concerned about data exposure are advised to check using dark web monitoring services or breach monitors like Have I Been Pwned.
The mystery of the M&S hack has deepened, with TCS claiming none of its systems were compromised.