Marks and Spencer Group PLC (LSE:MKS) chairman Archie Norman declined to comment on whether the retailer paid a ransom relating to the cyberattack earlier this year that cost it up to £300 million.
He said the ransomware attack was believed to have been carried out by a group called DragonForce, an operation based in Asia, not the previously suspected Scattered Spider.
Speaking to the Business and Trade Committee, Norman declined to comment on whether M&S paid a ransom, calling it a decision based on business and principles.
"The question you have to ask, and all businesses should ask, is when they look at the demand, what are they getting for it?" he said.
"Maybe they’ve exfiltrated data that you don’t want published, maybe there’s something there. "But in our case, substantially the damage had been done."
The company did not "leave the backdoor open" but was likely to have fallen victim due to its large "attack surface", with a number of overseas contractors, said Norman, who has also served as chief executive of Asda and chairman of ITV.
He confirmed that IT systems are still being rebuilt after the group's online operations, which were out of action for six weeks before reopening on 1 June.
"It’s not an overstatement to describe it as traumatic. And it has endured some weeks. We’re still in the rebuild mode, and we will be for some time to come," Norman told the committee, adding that customer-facing systems would be fully restored by the end of the month.
He hailed the importance of the retailer having made £870 million in profit in the past year, which put it in a position to absorb the disruption, otherwise "we’d have been kippered".