Marks & Spencer, Co-op, Harrods Security Incident

Home Blog From Marks & Spencer to Harrods: What the Retail Cyber Surge Reveals About Modern Threats From Marks & Spencer to Harrods: What the Retail Cyber Surge Reveals About Modern Threats May 8, 2025 From Marks & Spencer to Harrods: What the Retail Cyber Surge Reveals... In just two weeks, three of the UKs best-known retailers Marks & Spencer, Co-op and Harrods have each confirmed serious cyber incidents.The UKs National Cyber Security Centre (NCSC) has called these events a wake-up call, warning that every organisation should examine its readiness to detect, respond to and recover from an attack. These arent isolated IT issues. They are targeted, coordinated campaigns disrupting core business operations, from payments and logistics to customer data and digital identities. What Happened? A Quick Recap Marks & Spencer suffered a ransomware breach that disrupted contactless payments, Click & Collect services and online ordering. The attackers deployed DragonForce ransomware, compromising the companys virtual server infrastructure. Co-op initially described its incident as a contained intrusion. However, it has been confirmed that the theft of customer dataand internal messages suggests a deeper compromise. Attackers reportedly infiltrated Microsoft Teams, impersonating executives to deliver extortion messages directly to staff. Harrods detected an attempted breach and took pre-emptive action by restricting internet access across its estate. No data breach has been confirmed, but the investigation is ongoing. All three incidents are linked to a group known as Scattered Spider (also referred to as Octo Tempest by Microsoft - source )cybercriminals who specialise in identity-based compromise, helpdesk impersonationand social engineering . Why It Matters: The New Ransomware Playbook This new generation of attackers doesnt break down doorsthey log in through the front. They: Steal credentials using phishing and SIM swapping Hijack cloud identities and reset passwords...

... (truncated for display)