Major retailers are all vulnerable to IT outages after McDonald’s, Sainsbury’s and Tesco lost millions of pounds amid technical issues, retail experts have warned.
Tesco and Sainsbury’s were both hit with unrelated problems on Saturday which saw them both have to apologise to angry customers who were left without orders.
And that came one day after McDonald’s also said sorry to customers last Friday after they were unable to order food due to an IT system outage in its restaurants.
Sainsbury’s shoppers could not make contactless payments following an overnight software update and the firm could not fulfil the ‘vast majority’ of online deliveries.
Meanwhile, Tesco had to cancel some online orders due for delivery on Saturday – although it is understood that only a small proportion of these were impacted.
Now, retail experts have warned that the IT issues highlight ‘the fragility of growing dependence on digital infrastructure’ and showed ‘even large corporations aren’t immune from normal IT troubles’ amid concerns more firms could be affected.
A Sainsbury’s worked looks glum at the door of a store in Worthing, West Sussex, on Saturday
Long queues at the Sainsbury’s store in North Sheen near Richmond in London on Saturday
Shoppers appear to abandon their groceries at the Sainsbury’s in North Sheen on Saturday
While a total figure has not been given on the cost of the outages, the Telegraph estimated that Sainsbury’s orders worth up to £9million could have been affected.
This was based on analysis of the chain’s sales figures for 2022/23 when it sold an average of £8.7million in online delivery and click-and-collect orders each day.
Retail expert Richard Hammond, chief executive and co-founder of analytics firm Uncrowd, told : ‘Complex modern tech stacks are by their distributed nature rife with vulnerabilities.
‘We don’t know what this exact cause was but just one small part of the complex chain of dependencies can change one thing and that has unexpected consequences, including shutting down whole customer systems.
‘Retailers can’t even foresee that, they just can’t. What’s important is to have a disaster process in place for the ineviatable, and be ready to be humble and gracious in rebuilding customer trust.’
Richard Lim, chief executive of consultancy Retail Economics, told The Times: ‘While the immediate consequences of wasted food, lost revenue, and a potential erosion of customer trust are a blow to the retailer, the situation highlights a larger concern around operational resilience.
‘This incident underscores the fragility of growing dependence on digital infrastructure and the critical nature of investing in robust IT solutions.
‘Digital disruption is a principal risk for most retailers, but ensuring contingency planning is in place is vital.’
Retail technology analyst Miya Knights told BBC Radio 4 that any major update to a live system would require ‘rigorous testing protocols’ and ‘rigorous release planning’.
She added: ‘At the end of the day it’s a human-related problem that these things have come down to the point where they are affecting customers.’
Shoppers queue outside a Tesco store in London to withdraw cash on Saturday
An ATM machine outside a Tesco store in London on Saturday which was out of service
Guy Warren, chief executive of software company ITRS, told technology website Verdict that the three outages showed IT estates are growing more susceptible to outages with longer periods of downtime.
He said: ‘With operational resilience at the forefront of the business agenda, firms should already have introduced highly proactive monitoring and security capabilities, so they see what their systems are doing in real-time.
‘If these three companies had access to this level of insight, the outages across their platforms might never have happened – let alone drag on until it becomes headline news.’
And Chelsea Hopkins, PR manager at internet service provider Fasthosts, also told Verdict that the amount of sales lost will have been ‘staggering’.
She added: ‘When outages like this occur the first thought for many is a cyber attack, but this is a reminder that even large corporations aren’t immune from normal IT troubles.’
It is understood that the IT failures are not being investigated as a potential cyber attack at any of the three firms.
James Bore, who runs the Bores technology and security consultancy, often deals with situations relating to supply chains, logistics and overall societal security.
He told : ‘There’s a rule in technology- never deploy on a Friday. The technology involved in these systems has only grown more fragile and complex over the years, and there is rarely an incentive to reduce the complexity or rebuild them properly from the ground up.
‘At this scale and complexity thorough testing is essential, as even the slightest mistake can have unpredictable consequences – as we’ve seen.
‘This is a fundamental risk of centralised control of systems by large companies – when these systems are not centralised any failures are local and so impacts are limited. Despite the impact of these, it could have easily been much worse.’
There were long queues at the Sainsbury’s in Wandsworth, South West London, on Saturday
He also warned of the dangers of relying too much on cashless payment methods.
Mr Bore explained: ‘Moving to a cashless society means moving to a single system to manage all payments.
‘Ignoring issues around privacy and control, any failures in the system would have far more potential to be catastrophic, not to mention without a solid design dependencies on energy and connectivity could easily be introduced.
‘On top of that, a vulnerability in the design of the system would put anyone from individuals to society as a whole at risk.
‘These dangers can be partly designed around, for example the European Central Bank’s proposal includes an offline component that retains the anonymity of cash along with many of its benefits – but does still require electricity and any such offline digital currency is at risk of theft along with the device carrying it.’
Sainsbury’s had said that it could not deliver most online grocery orders and was unable to contact customers directly.
But a Sainsbury’s spokesperson later said: ‘We can confirm that contactless payments are now back up and running in all stores, alongside all other forms of payment.
‘Our Groceries Online ordering system is working as normal and customers can place an order for delivery any time from tomorrow.
‘We apologise to customers for the inconvenience caused by technical issues today – thank you for bearing with us.’
One customer said she was meant to have a ‘very important’ order delivered between 8 to 9am, which did not happen.
Yvonne, 56, from the Reading area, said: ‘The main issue I have with this is the poor communication from Sainsbury’s to its customers.
‘It was obvious something was wrong at 7am as that’s when they send the receipts normally. Couldn’t get through to anyone about my 8 to 9 delivery.
‘No statement until about 8.30, only seemed to be on social media which not all customers will have.
A Sainsbury’s in Wandsworth, South West London, said that tills were ‘cash only’ on Saturday
‘Should have been an email or text to customers which would have helped those like myself expecting an early morning delivery. Much to improve on with their communications.’
Argos, which is owned by Sainsbury’s, was also affected by the software update, meaning some customers may have had issues ordering new items or collecting orders in-store.
It said there may have been delays in fulfilling orders placed.
READ MORE Panic buttons, bodycams and instant back-up: How Boots are fighting back against shoplifting gangs with help of CCTV nerve centre
Only a small proportion of Tesco orders due for delivery on Saturday were impacted, it is understood.
Tesco customers received an email if their order was disrupted, and if it was cancelled they were not charged.
In-store shopping and placing orders on the app and website are not believed to have been affected.
Tesco said: ‘The vast majority of our online orders are being delivered as normal, but due to a technical issue earlier today we have had to cancel a small number of orders.
‘We are contacting affected customers directly, and we’re really sorry for the inconvenience.’
It comes after McDonald’s apologised to customers last Friday after they were unable to order food following an IT system outage in its restaurants.
The fast food operator later said the problem had been ‘resolved’ at its sites in the UK and Ireland.
On Friday morning, customers in the UK, , New Zealand and Japan complained about issues trying to buy from the fast food giant on social media.
In the UK, a number of customers said on social media that their local restaurants were closed although they were able to make orders through the company’s app.
Most stores across the UK opened as usual on Friday morning despite the problem.
The company blamed the issue on a ‘technology outage’ and stressed that it was not linked to any cybersecurity issues.
A McDonald’s spokeswoman said: ‘We are aware of a technology outage which impacted our restaurants.
‘The issue has now been resolved in the UK and Ireland. We thank customers for their patience and apologise for any inconvenience this may have caused. The issue is not related to a cybersecurity event.’