Marks and Spencer Breach Incident Score: Analysis & Impact (DAVCAECHAPOWKASFILMARSOLNAS1770898846)

In this Rankiteo incident briefing, we review the Marks and Spencer breach identified under incident ID DAVCAECHAPOWKASFILMARSOLNAS1770898846.

The analysis begins with a detailed overview of Marks and Spencer's information like the linkedin page: https://www.linkedin.com/company/marks-and-spencer, the number of followers: 736458, the industry type: Retail and the number of employees: 41277 employees

After the initial compromise, the video explains how Rankiteo's incident engine converts technical details into a normalized incident score. The incident score before the incident was 504 and after the incident was 473 with a difference of -31 which is could be a good indicator of the severity and impact of the incident.

In the next step of the video, we will analyze in more details the incident and the impact it had on Marks and Spencer and their customers.

PowerSchool recently reported "Ransomware Trends and High-Profile Attacks (2024-2025)", a noteworthy cybersecurity incident.

Ransomware remains a critical threat to governments, businesses, and critical infrastructure, disrupting healthcare, fuel distribution, retail, and identity security.

The disruption is felt across the environment, affecting Healthcare, Fuel distribution and Retail, and exposing 62M students and 9.5M teachers (PowerSchool), 5.6M patient records (Yale New Haven Health) and 1TB of data (NASCAR), with nearly ['62M', '9.5M', '5.6M', '1TB', '2.7M', '193M', '16.6M'] records at risk.

Formal response steps have not been shared publicly yet.

Overall, the incident is a reminder of why proactive monitoring and strong governance matter.

Finally, we try to match the incident with the MITRE ATT&CK framework to see if there is any correlation between the incident and the MITRE ATT&CK framework.

The MITRE ATT&CK framework is a knowledge base of techniques and sub-techniques that are used to describe the tactics and procedures of cyber adversaries. It is a powerful tool for understanding the threat landscape and for developing effective defense strategies.

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Supply Chain Compromise (T1195) with high confidence (90%), supported by evidence indicating supply Chain Attacks – Threat actors target software vendors (e.g., SolarWinds, Kaseya, MoveIt), Phishing (T1566) with moderate to high confidence (80%), supported by evidence indicating phishing remains a primary infection vector; AI enhances social engineering lures, and Exploit Public-Facing Application (T1190) with moderate to high confidence (70%), supported by evidence indicating exploiting Unpatched Systems – Most ransomware exploits known flaws in outdated software. Under the Execution tactic, the analysis identified User Execution (T1204) with moderate to high confidence (70%), supported by evidence indicating phishing remains a primary infection vector for ransomware execution and Command and Scripting Interpreter (T1059) with moderate confidence (60%), supported by evidence indicating ransomware-as-a-Service (RaaS) tools often include scripting for automation. Under the Persistence tactic, the analysis identified Supply Chain Compromise: Compromise Software Supply Chain (T1195.002) with moderate to high confidence (80%), supported by evidence indicating supply chain attacks (e.g., SolarWinds, Kaseya) enable persistent access to downstream victims. Under the Privilege Escalation tactic, the analysis identified Exploitation for Privilege Escalation (T1068) with moderate confidence (60%), supported by evidence indicating exploiting unpatched systems often leads to privilege escalation in ransomware attacks. Under the Defense Evasion tactic, the analysis identified Obfuscated Files or Information (T1027) with moderate to high confidence (70%), supported by evidence indicating ransomware often uses encryption to evade detection (e.g., data encrypted for impact) and Impair Defenses: Disable or Modify Tools (T1562.001) with moderate confidence (60%), supported by evidence indicating ransomware may disable security tools to avoid detection during encryption. Under the Credential Access tactic, the analysis identified Brute Force (T1110) with moderate confidence (50%), supported by evidence indicating phishing and unpatched systems may lead to credential harvesting in ransomware attacks and Credentials from Password Stores (T1555) with moderate confidence (50%), supported by evidence indicating ransomware groups may access stored credentials during lateral movement. Under the Discovery tactic, the analysis identified File and Directory Discovery (T1083) with moderate to high confidence (70%), supported by evidence indicating ransomware groups exfiltrate data (e.g., 1TB from NASCAR, 193M from Change Healthcare) and System Information Discovery (T1082) with moderate confidence (60%), supported by evidence indicating ransomware often maps systems to identify high-value targets for encryption/exfiltration. Under the Lateral Movement tactic, the analysis identified Exploitation of Remote Services (T1210) with moderate to high confidence (70%), supported by evidence indicating supply chain attacks (e.g., Kaseya) enable lateral movement to downstream victims. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (90%), supported by evidence indicating data exfiltrated such as 62M students (PowerSchool), 193M victims (Change Healthcare) and Data from Cloud Storage (T1530) with moderate confidence (60%), supported by evidence indicating ransomware groups target cloud-stored data (e.g., healthcare, education records). Under the Command and Control tactic, the analysis identified Application Layer Protocol (T1071) with moderate to high confidence (70%), supported by evidence indicating ransomware groups use C2 channels for data exfiltration and encryption commands. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), supported by evidence indicating 1TB of data stolen (NASCAR), 193M victims (Change Healthcare); data exfiltration confirmed and Exfiltration Over Web Service (T1567) with moderate confidence (60%), supported by evidence indicating ransomware groups may use web services for data exfiltration (e.g., cloud storage). Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with high confidence (90%), supported by evidence indicating ransomware strains (Clop, Medusa) encrypt data; 88% of SMB breaches involved ransomware, Data Destruction (T1485) with moderate confidence (50%), supported by evidence indicating ransomware may destroy data if ransom is not paid (e.g., operational disruptions), Defacement (T1491) with lower confidence (40%), supported by evidence indicating ransomware groups may deface systems as part of extortion (e.g., ransom notes), and Inhibit System Recovery (T1490) with moderate to high confidence (70%), supported by evidence indicating ransomware often deletes backups to prevent recovery (e.g., operational disruptions). These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.