Marks & Spencer – Ransomware Storm
Starting in April and stretching into May, M&S was struck by coordinated attacks from Scattered Spider and DragonForce, leveraging social engineering and targeted phishing on a third-party supplier. The breach affected over 600 systems, stole approximately 150 GB of data, and halted online sales for six weeks. Estimated losses topped £300 million in profits, plus an estimated £40 million/week in lost sales.
Co‑op – Customer Data Compromised.
The Co‑op reported that a “significant amount” of customer data—names, contact info, and dates of birth—was extracted in mid-May by the same DragonForce group.
While no financial data was taken, operations were disrupted as systems were temporarily shut down.
Harrods – Broad Supply Chain Attack
On the 1st May. Harrods was confirmed as the third UK retail victim, experiencing system breaches attributed to the wider retail campaign.
Although internet access was restricted in stores, systems remained operational under NCSC guidance.
Common Causes & Tactics
- Social engineering & phishing: Criminals manipulated suppliers to gain privileged access, highlighted in the M&S attack via an outsourced IT support password reset.
- Ransomware gangs coordinating across targets: DragonForce orchestrated a broad campaign targeting major UK retailers.
- Third-party and supply chain vulnerabilities: Attacks exploited weak security among suppliers, a pervasive theme in May breaches.
Impacts Felt Across the Board
- Financial Impact: M&S’s operations were stalled for six weeks, slashing profits by ~£300 million and wiping out market cap gains.
- Customer trust shaken: Co‑op and Harrods reported data theft and system outages, prompting customers to adapt their behaviour amid fear of scams.
- Law enforcement crackdown: The NCA arrested four suspects aged 17–20 in May as part of a national operation targeting these coordinated attacks.
Key Lessons for UK Businesses
- Phishing remains the #1 threat: Attackers continue to home in on human vulnerabilities.
- Segment your internal & third-party systems: Lateral movement from a single vendor can compromise your entire operation.
- Rapid incident response pays off: Quick detection and containment minimise operational and reputational damage.
- Board-level awareness is essential: These attacks expose the vital need for executive governance and investment in cybersecurity.
Your Call to Action
Don’t wait for the next headline. Take control of your security posture now. Contact us to turn these lessons into your next line of defence, and safeguard your reputation, operations, and customer trust.