Marks and Spencer Group PLC (LSE:MKS) chief executive Stuart Machin said "human error" was at fault for hackers gaining access to its IT systems through a third party.
On a call with analysts and reporters after the group's annual results announcement, Machin said he could not comment on whether a ransom had been paid in the cyber attack, for which the retailer today estimated would cost it about £300 million.
"We didn’t leave the door open, this wasn’t anything to do with under-investment," he insisted.
Customer data, reportedly including names, email addresses, postal addresses and dates of birth, was taken by hackers in the attack.
Online orders were paused because of the attack, with disruption potentially continuing into July, the FTSE 100 company said today - though it hopes to have this partly restored "within weeks".
Machin said on the post-results call that the company was "on the road to recovery" and "getting back to business".
It is believed the group was hacked by a group known as Scattered Spider, who were linked to a similar attack on the Co-op and Harrods.