MS
Company Details
Linkedin ID:
marks-and-spencer
Employees number:
39,274
Number of followers:
686,846
NAICS:
43
Industry Type:
Homepage:
marksandspencer.com
IP Addresses:
0
Company ID:
MAR_2661945
Scan Status:
In-progress
Marks and Spencer Company CyberSecurity Posture
marksandspencer.com
At M&S, we're dedicated to being the most trusted retailer, prioritising quality and delivering value. Every day, we bring the magic of M&S to our customers, whenever, wherever and however they want to shop with us. For over a century, we've set the standard, doing the right thing and embracing innovation. Today, with over 65,000 colleagues serving 32 million customers globally, we're putting quality products at the heart of everything we do. Tomorrow holds boundless opportunities with us. We're pioneering digital innovation and shaping the future of retail where our values drive every action. We stay close to customers and colleagues, always curious and connected. Our decisions are bold, our actions ambitious. Transparency is paramount, with straightforward, honest communication. We're constantly innovating, always striving for the best. Our focus is on aiming higher and winning together, combined with wise financial decisions to secure our future. Join us at M&S to shape the future of retail.
Marks and Spencer A.I CyberSecurity Scoring
MS Risk Score (AI oriented)Between 0 and 549
MS
Updated:
- Powered by our proprietary A.I cyber incident model
- Insurance preferes TPRM score to calculate premium
MS Global Score (TPRM)XXXX
MS
- Instant access to detailed risk factors
- Benchmark vs. industry & size peers
- Vulnerabilities
- Findings
MS Company CyberSecurity News & History
Past Incidents
30
Attack Types
3
Marks & Spencer (M&S)
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: Earlier this week, M&S reported a cyberattack that disrupted its online services for more than three weeks. The attack, believed to be linked to the hacking group 'Scattered Spider,' resulted in the compromise of certain customer data. M&S has informed customers that due to the sophisticated nature of the incident, some of their personal customer data has been taken.
Marks and Spencer (M&S)
Cyber Attack
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: Marks and Spencer (M&S), a high-profile British retailer, suffered a **cybersecurity breach** in early 2024, as referenced in the article. The attack, attributed to an organized group like *Scattered Spider*, likely involved **data compromise and reputational damage**. While specifics of the breach (e.g., type of data stolen, financial loss, or operational disruption) were not detailed, the article highlights the company’s **proactive crisis response**: the CEO issued **timely digital communications** to maintain customer trust and regulatory compliance. The incident underscores the **financial and reputational risks** of modern cyber threats, particularly for large enterprises. M&S’s rapid transparency—addressing stakeholders within days—suggests the breach may have involved **customer data exposure or financial fraud risks**, though no ransomware was explicitly mentioned. The attack aligns with broader trends of **targeted campaigns against retail and critical infrastructure**, emphasizing the need for robust backup systems, incident response plans, and C-suite accountability in cyber resilience.
Marks & Spencer
Cyber Attack
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: Marks & Spencer, a British retail chain, revealed on Tuesday that some of its customers' personal data had been stolen in a cyberattack. The incident was sophisticated and led to the suspension of online sales and contactless payments. The company emphasized that no payment details or passwords were compromised. Affected customers were notified, but the exact number was not disclosed. The company assured that no further action was necessary beyond resetting passwords. There is no indication that the stolen data has been shared. M&S reported the incident to relevant authorities and law enforcement and continues to collaborate with them.
Marks and Spencer (M&S)
Cyber Attack
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: British retailer **Marks and Spencer (M&S)** suffered a **cyberattack** leading to the compromise of **customer personal data**, including names, home/email addresses, and phone numbers—though no payment details or passwords were exposed. The attack caused **operational disruptions**, with **online shopping still unavailable** and **in-store shortages** due to 'technical issues' affecting product availability. M&S’s share price dropped **11% over the past month**, and customers were advised to reset passwords as a precaution, though no evidence of data misuse was found. The incident was **claimed by the DragonForce ransomware group**, but this remains unverified. The **National Cyber Security Centre (NCSC)** is investigating potential links to similar attacks on other UK retailers, including Co-op and Harrods, while working to mitigate further harm.
Marks and Spencer
Cyber Attack
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: Marks and Spencer (M&S) suffered a significant cyberattack on April 22, 2025, which compromised customer data including home addresses, phone numbers, and dates of birth. The attack is estimated to cost the company around £300 million in lost operating profit. The DragonForce hacking collective claimed responsibility, demanding payment for the attack. While no passwords or card details were stolen, the breach has raised concerns about data security.
Marks and Spencer Group (M&S)
Cyber Attack
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: Marks and Spencer (M&S) suffered a cyberattack in April, where hackers—linked to the cybercrime groups **Scattered Spider** and **DragonForce**—accessed customer data. While no usable payment card details or passwords were stolen, compromised information includes **basic contact details, dates of birth, online order histories, and customer reference numbers** for M&S credit card or Sparks Pay holders. The attack disrupted online purchases and impacted store inventories. Customers were advised to reset passwords and remain vigilant against phishing and fraudulent communications exploiting the stolen personal data. The UK’s National Cyber Security Centre (NCSC) confirmed involvement, warning of potential follow-up social engineering attacks. Though financial data was masked, the breach poses risks of identity fraud and targeted scams.
Marks & Spencer (M&S)
Cyber Attack
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Marks & Spencer (M&S) suffered a significant cyber attack executed by the hacking group **ScatteredSpider**, resulting in a **£300 million loss in profits**. The attack disrupted M&S’s systems, highlighting the severe financial and operational consequences even for well-established brands. The incident underscores the escalating threat landscape, where sophisticated cybercriminals—empowered by AI and **Cybercrime-as-a-Service (CaaS)**—target high-profile organizations. Beyond immediate financial damage, the breach eroded customer trust, increased recovery costs, and exposed vulnerabilities in M&S’s cybersecurity posture. The attack serves as a stark warning to businesses of all sizes, emphasizing the need for **proactive security measures** rather than reactive responses. With cyber insurance premiums rising and regulatory pressures (e.g., the upcoming **Cyber Security and Resilience Bill**) mandating resilience, M&S’s case illustrates how inadequate defenses can lead to **long-term reputational harm** and **operational disruptions**, particularly when critical systems or financial data are compromised.
Marks & Spencer
Cyber Attack
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Marks & Spencer (M&S) suffered a **major cyber-attack in April**, forcing the company to **halt online orders for nearly seven weeks**. The disruption led to a **20% decline in clothing sales** over a four-week period ending 25 May, causing significant financial losses and competitive setbacks against rivals like Next, Zara, and H&M. The attack disrupted core e-commerce operations, directly impacting revenue streams and customer trust. While the article does not specify data theft, the prolonged outage suggests a **targeted disruption of business-critical systems**, likely involving operational technology or payment processing infrastructure. The incident underscores vulnerabilities in digital supply chains, particularly as cybercriminals leverage increasingly sophisticated methods, including AI-driven attacks. The financial and reputational damage aligns with broader industry warnings about outdated systems (e.g., unpatched software like Windows 7) exacerbating risks in smart, interconnected environments.
Marks & Spencer (M&S)
Cyber Attack
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Marks & Spencer (M&S) suffered a severe cyber-attack linked to the hacking collective *Scattered Spider*, causing widespread operational disruptions. The attack forced the shutdown of its online shop for nearly a week, halting all customer orders and resulting in a **£650 million drop in stock market value**. Critical systems were compromised, including automated stock management, leading to **product shortages on shelves**, and disruptions to its **loyalty scheme and gift card payments**. The company also **paused all hiring processes**, removing over 200 job listings from its website due to compromised recruitment systems. While stores remained open, the incident severely impacted revenue, supply chain efficiency, and customer trust. The National Cyber Security Centre (NCSC) and Metropolitan Police are investigating, with concerns that the attack could exploit vulnerabilities in **SAP systems**—shared by other retailers—potentially enabling further breaches across the sector.
Marks & Spencer (M&S)
Cyber Attack
Rankiteo Explanation
Attack threatening the organization's existence
Description: British retail giant **Marks & Spencer (M&S)** suffered a devastating **cyberattack in April 2025**, orchestrated by the **Scattered Spider** group via **third-party vendor impersonation**, exploiting credentials from **TCS help-desk employees**. The breach forced M&S to **shut down its online shopping platform**, suspend **click-and-collect services**, and disrupt **supply chain operations**, leading to **empty shelves in physical stores**. The financial impact was severe, with **£300 million in lost operating profit** and **£1 billion wiped from market capitalization**. The attack **damaged M&S’s reputation**, eroded customer trust, and prompted the **termination of its long-standing IT support contract with TCS**. The incident underscored vulnerabilities in **outsourced vendor access**, **social engineering risks**, and **supply chain cybersecurity**, causing **operational paralysis** and **competitive disadvantage** as rivals gained market share during the outage.
Marks & Spencer (M&S)
Cyber Attack
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Marks & Spencer suffered a severe cyber-attack during a peak summer trading period, crippling its transactional systems and causing widespread operational disruption. The attack led to stock availability issues, preventing customers from purchasing products both in-store and online, with the website failing to accept orders for an extended period. As a result, M&S reported a **55.4% plunge in adjusted pre-tax profits** (from £413.1m to £184.1m in H1 2025), despite a 22.1% sales increase, as rivals like Next capitalized on its downtime. The incident eroded customer trust, with slower recovery in clothing sales suggesting long-term loyalty risks. While a **£100m insurance payout** mitigated some financial damage, the attack exposed critical vulnerabilities in M&S’s cybersecurity and supply chain, prompting accelerated tech investments. The timing—during a high-demand summer—amplified losses, as the retailer failed to capitalize on seasonal sales. Recovery efforts now focus on rebuilding customer confidence, upgrading systems, and reviving brand appeal ahead of the crucial Christmas period, though broader economic pressures (e.g., potential tax hikes) threaten further challenges.
Marks & Spencer
Ransomware
Rankiteo Explanation
Attack limited on finance or reputation
Description: In early 2025, a coordinated ransomware campaign by the DragonForce group infiltrated Marks & Spencer’s IT environment, deploying its encryptor on VMware ESXi hosts that supported critical e-commerce and payment platforms. The attack forced M&S to suspend all online sales for five days while IT teams worked to restore encrypted virtual machines and sanitize systems. During this blackout, the retailer incurred estimated daily losses of £3.8 million from halted transactions and customer attrition. Investor confidence also took a hit, with the company’s market capitalization dropping by over £500 million as trading in M&S shares reflected concerns about operational resilience and surge protection. Although no customer data was exfiltrated, the incident exposed gaps in patch management and incident response processes. Post-incident assessments highlighted the need for stronger network segmentation, faster ransomware detection capabilities, and robust backup and recovery workflows. M&S has since accelerated its cybersecurity investment, deploying next-generation endpoint protection and multi-factor authentication across its cloud and on-premises infrastructure to mitigate future threats.
Marks & Spencer (M&S)
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: In 2025, Marks & Spencer (M&S) suffered a high-profile cyberattack over Easter, involving **ransomware**, **payment system disruption**, and **third-party exploitation**. The breach caused **major operational downtime**, leading to significant **financial losses** due to halted transactions and recovery efforts. The attack disrupted business continuity, eroded **customer trust**, and exposed vulnerabilities in M&S’s supply chain and internal security posture. While the exact scale of data exposure remains undisclosed, the incident highlighted the retailer’s susceptibility to **multi-vector attacks**, combining credential abuse, lateral movement, and ransomware deployment. The fallout included reputational damage, regulatory scrutiny, and the urgent need for overhauls in **identity access management**, **real-time threat detection**, and **incident response protocols**. The attack underscored how even established brands with sophisticated defenses remain at risk without **proactive visibility** across digital infrastructure.
M&S (Marks & Spencer)
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: In Q2 2025, M&S suffered a **massive ransomware breach** that led to **empty shelves** across stores, severely disrupting operations during a critical sales period. The attack compromised internal systems, halting supply chain logistics and point-of-sale transactions. While the article does not specify whether customer or employee data was exfiltrated, the operational outage alone threatened the company’s financial performance, particularly if it had coincided with peak retail seasons like Black Friday or Christmas. The incident underscored vulnerabilities in M&S’s cyber defenses, exposing gaps in continuous assurance and resilience. Experts warned that such disruptions—if timed during high-stakes profit windows—could push losses into catastrophic territory, jeopardizing annual targets and brand reputation. The breach aligns with broader trends where ransomware groups exploit organizational distractions (e.g., holidays) to maximize damage.
Marks & Spencer (M&S)
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Marks & Spencer (M&S), one of Britain’s most prominent retailers, suffered a **ransomware attack** attributed to the hacking collective *Scattered Spider* using the *DragonForce encryptor*. The attack forced M&S to **shut down critical systems**, including its **website and app**, halting clothing and home orders for **six days** during peak summer demand. Some **food product availability** was also disrupted in stores. The incident caused **operational outages**, financial losses from lost sales, and reputational damage during a high-revenue period. Cybersecurity experts noted the group’s aggressive tactics, including **phishing, MFA bombing, and SIM swapping**, targeting IT help desks. The attack aligns with Scattered Spider’s history of high-profile ransomware campaigns, such as those against *Caesars Entertainment* and *MGM Resorts* in 2023. The **National Cyber Security Centre (NCSC)**, **National Crime Agency (NCA)**, and **Metropolitan Police’s Cyber Crime Unit** are investigating, underscoring the attack’s severity and potential broader economic impact on the UK retail sector.
Marks and Spencer
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: A damaging cyber-attack on retailer Marks and Spencer in the UK in April last year has caused a great loss in revenues, with a £300 million ($403 million) operating profit loss, as its online business was taken offline for seven weeks, and is being rebuilt in stages with the process not yet complete 14 months later. The attack was enabled by a DragonForce ransomware group hacker impersonating an employee, reportedly at M&S contractor Tata Consultancy Services, and gaining unauthorized system access via the M&S help desk. Reports indicate the breach began as early as February 2024, when hackers stole the Windows domain’s NTDS.dit file, containing password hashes for domain users. By cracking these hashes, they accessed the network and deployed ransomware to encrypt virtual machines, disrupting services like contactless payments, click-and-collect, and online ordering.
Marks & Spencer
Ransomware
Rankiteo Explanation
Attack threatening the organization's existence
Description: British retailer giant Marks & Spencer (M&S) is facing a potential profit hit of up to £300 million following a recent ransomware attack that led to widespread operational and sales disruptions. The company confirmed that online retail systems are disabled and expects disruptions to last until July. Food sales have been impacted by reduced availability, and the company has incurred additional waste and logistics costs. Online sales and trading profit in Fashion, Home & Beauty have also been heavily impacted. The attack was linked to the Scattered Spider group, who used a DragonForce encryptor to encrypt virtual machines on VMware ESXi hosts, leading to significant business disruptions and the theft of customer data.
Marks & Spencer (M&S)
Ransomware
Rankiteo Explanation
Attack threatening the organization's existence
Description: Marks & Spencer (M&S), a major British retailer, suffered a **cyberattack attributed to the ScatteredSpider hacking group**, resulting in **widespread outages across its physical stores and online platform**. The attack disrupted core business operations, leading to **significant revenue loss** due to downtime in both in-store and digital sales channels. The incident also triggered a **7% drop in M&S’s share price**, translating to millions in financial losses from lost transactions, operational halts, and reputational damage. The attack leveraged **ransomware tactics**, holding the retailer’s systems hostage and directly impacting customer-facing services—a critical vulnerability for businesses reliant on continuous revenue streams. Security experts highlight the **high cost of operational downtime in retail**, amplifying the attackers’ leverage for extortion. While the full scope of data compromise remains undisclosed, the disruption underscores the **severe financial and reputational risks** posed by targeted cyber incidents in the sector. The NCSC and cybersecurity leaders have warned that such attacks are increasingly sophisticated, exploiting AI-driven social engineering to breach networks, with retailers being prime targets due to their vast customer data repositories.
Marks & Spencer
Ransomware
Rankiteo Explanation
Attack threatening the organization's existence
Description: Marks & Spencer (M&S), a prominent UK retailer, fell victim to a coordinated ransomware attack linked to the **DragonForce** cartel and its affiliate **Scattered Spider**. The incident involved the deployment of DragonForce-built ransomware, leveraging Conti’s leaked source code with advanced encryption (ChaCha20 + RSA) and network-spreading capabilities via SMB. The attack targeted both local and shared network storage, with operators threatening to **delete decryptors and leak stolen data** if ransom demands were unmet by deadlines (September 2 and 22).The breach disrupted M&S’s operations, risking **customer data exposure**, financial fraud, and reputational damage due to media coverage. DragonForce’s cartel model—recruiting affiliates like Devman and Scattered Spider—amplified the attack’s sophistication, combining initial access tactics with aggressive data exfiltration. While the full scope of compromised data (e.g., payment details, personal records) remains undisclosed, the incident aligns with DragonForce’s pattern of **high-impact extortion**, including threats to publish sensitive information. The attack underscores the escalating risks posed by ransomware-as-a-service (RaaS) ecosystems, where collaborative cybercriminal groups exploit enterprise vulnerabilities for maximal disruption and profit.
M&S
Ransomware
Rankiteo Explanation
Attack threatening the organization's existence
Description: M&S experienced a ransomware attack carried out by DragonForce, a group believed to be based in Asia or Russia. The attack involved social engineering, where the attacker impersonated an M&S worker and tricked a third party into resetting an employee's password. The attackers threatened to leak and encrypted acquired data, including names, birth dates, addresses, phone numbers, household information, and order histories. About 150GB of data was stolen before M&S shut down systems to prevent further spread, leading to delivery disruptions. Recovery efforts are ongoing, with full recovery expected by October or November 2025.
Marks & Spencer (M&S)
Ransomware
Rankiteo Explanation
Attack threatening the organization's existence
Description: Marks & Spencer (M&S) suffered a **cyberattack in April**, attributed to the **DragonForce ransomware group**, causing severe operational and financial disruptions. The attack **disabled its app and online shopping platform**, leading to **lost sales in Fashion, Home & Beauty**, while **Food sales were hit by stock shortages and manual process inefficiencies**, incurring additional waste and logistics costs. The company expects a **£300 million (~$402M) hit to annual profits**, excluding direct incident costs, with disruptions persisting into **July**. Customer data may have been compromised, though not yet leaked on darknet extortion sites. M&S is claiming up to **£100M from insurance** and accelerating IT infrastructure upgrades. The attack coincided with similar incidents at **Co-op and Harrods**, though no official linkage has been confirmed. Share prices initially dipped but rebounded slightly, though remain **8.8% below pre-attack levels**.
Marks & Spencer (M&S)
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Marks & Spencer (M&S), a major UK retailer, was targeted in a **ransomware attack** that disrupted its internal systems and locked employees out of critical files. The attack exploited vulnerabilities in enterprise backup strategies, highlighting the inadequacy of conventional cybersecurity measures when backups are not properly isolated. While the incident did not explicitly confirm data theft or financial loss, the operational disruption—including potential downtime, employee lockout, and reliance on negotiation with cybercriminals—underscores the attack’s severe impact on business continuity. The breach also raises broader concerns about the effectiveness of traditional backup solutions, as similar failures have occurred in other high-profile cases (e.g., Capital Health, NHS). The attack reinforces the need for offline, air-gapped storage to prevent encryption or deletion of backups, though such solutions introduce logistical and financial challenges.
Marks and Spencer
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Marks and Spencer (M&S) has confirmed that customer information has been taken following a cyberattack. The attack has caused significant disruption, with online orders still affected weeks later. In a letter to customers, the retail giant revealed that personally identifiable information (PII) has been stolen by cybercriminals. This forced the firm to disable online shopping orders, click and collect, and contactless payments in some stores. The incident, which seems to have been a ransomware attack, took systems offline and caused undeniable disruption to the retailer’s operation.
Marks & Spencer (M&S)
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Marks & Spencer (M&S) suffered a **sophisticated ransomware attack** on **17 April**, detected two days later, forcing its **online store to shut down for nearly seven weeks**. The attack, linked to **DragonForce ransomware specialists** and the hacking group **Scattered Spider**, targeted M&S’s **key online clothing distribution center in Castle Donington**, which remained offline during recovery. The retailer described the incident as **‘traumatic’**, likening it to an **‘out-of-body experience’**, with **gross lost profits estimated at £300 million** (partially offset by a £100m+ insurance claim). The attack involved **impersonation and a third-party contractor**, bypassing M&S’s **£100m+ cybersecurity investments** and **80-person prevention team**. While M&S reported the breach to the **NCSC, FBI, NCA, and Met Police**, it refused to confirm ransom payments, stating the **‘damage was already done’**. The company was still in **‘rebuild mode’** months later, with full online operations expected to resume by the end of the month.
Marks & Spencer
Ransomware
Rankiteo Explanation
Attack threatening the organization's existence
Description: Marks & Spencer (M&S) experienced a ransomware attack in April, linked to the Scattered Spider hacking collective using DragonForce ransomware. The attack, which was highly sophisticated and involved social engineering through a third party, compromised the retailer's systems significantly. M&S had to shut down large parts of its systems to prevent further damage, heavily affecting areas such as online shopping. The attack was so severe that it was described as an attempt to destroy the business. The retailer is still in the process of securely bringing these systems back up.
Marks & Spencer (M&S)
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Marks & Spencer (M&S), a leading British retail giant, suffered a **ransomware attack** attributed to the hacking group *Scattered Spider* (Octo Tempest) using the *DragonForce* ransomware. The attack disrupted **online orders, contactless payments, click-and-collect services, and gift card processing**, forcing the company to halt all digital sales—a channel generating ~£3.8M in daily revenue. The incident caused **supply chain disruptions**, leading to empty shelves, shortages of key products (e.g., Percy Pigs sweets), and the furlough of 200 warehouse workers. Over **£700M was wiped from M&S’s market value**, with shares dropping 6.5%, while recruitment froze (200+ job listings removed). The attack also triggered a **Metropolitan Police investigation**, though M&S has not confirmed data breaches. Systems remained offline for over a week, with no recovery timeline provided. The **NCSC warned retailers to bolster cybersecurity**, highlighting the attack’s severe operational and financial fallout.
M&S
Ransomware
Rankiteo Explanation
Attack threatening the organization's existence
Description: M&S, a major UK retail giant, has been severely impacted by a highly sophisticated cyber campaign attributed to the financially motivated hacking group Scattered Spider. The attackers exploited compromised Active Directory accounts to gain full control of VMware vSphere environments, stealing sensitive data and deploying ransomware. This method bypasses traditional security tools, rendering it invisible to in-guest security agents. The attack not only compromised financial and personal data but also disrupted business operations, causing significant financial loss and damage to the company's reputation.
Marks and Spencer (M&S)
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Marks and Spencer (M&S) suffered a **significant ransomware attack** over the Easter weekend, with repercussions lasting over two months. The attack **suspended all online orders** and **disabled contactless payments** in physical stores, severely disrupting operations. While customer data was accessed, M&S confirmed that **payment details and passwords remained secure**. However, the financial fallout was catastrophic—**£300 million was wiped from its market value**, marking it as the **most financially damaging cyber attack in UK retail history**. Recovery has been slow, with some online ordering and delivery services still unavailable weeks later. The attack not only crippled revenue streams but also eroded customer trust, risking long-term reputational harm. The incident aligns with a broader trend of retailers being targeted for their vast customer databases and critical payment infrastructure, amplifying operational and financial vulnerabilities.
Marks & Spencer (M&S)
Ransomware
Rankiteo Explanation
Attack threatening the organization's existence
Description: In late April 2025, Marks & Spencer (M&S) was targeted by a ransomware attack linked to the Scattered Spider threat actor. This incident caused significant operational disruption and financial costs, affecting the company's ability to operate normally. The attack disrupted the retailer's supply chain and likely led to the exposure of customer data and payment information, making it a high-severity incident.
Marks & Spencer
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: British retailer giant Marks & Spencer (M&S) was breached in an April ransomware attack where a DragonForce encryptor was used to encrypt virtual machines on VMware ESXi hosts, forcing M&S to stop accepting online orders and leading to a significant impact on business operations at its 1,400 stores.
MS Company Scoring based on AI Models
Cyber Incidents Likelihood 3 - 6 - 9 months
A.I Risk Score Likelihood 3 - 6 - 9 months
Underwriter Stats for MS
Incidents vs Retail Industry Average (This Year)
Marks and Spencer has 7614.29% more incidents than the average of same-industry companies with at least one recorded incident.
Incidents vs All-Companies Average (This Year)
Marks and Spencer has 4053.85% more incidents than the average of all companies with at least one recorded incident.
Incident Types MS vs Retail Industry Avg (This Year)
Marks and Spencer reported 27 incidents this year: 9 cyber attacks, 17 ransomware, 0 vulnerabilities, 1 data breaches, compared to industry peers with at least 1 incident.
Incident History — MS (X = Date, Y = Severity)
MS cyber incidents detection timeline including parent company and subsidiaries
MS Company Subsidiaries
At M&S, we're dedicated to being the most trusted retailer, prioritising quality and delivering value. Every day, we bring the magic of M&S to our customers, whenever, wherever and however they want to shop with us. For over a century, we've set the standard, doing the right thing and embracing innovation. Today, with over 65,000 colleagues serving 32 million customers globally, we're putting quality products at the heart of everything we do. Tomorrow holds boundless opportunities with us. We're pioneering digital innovation and shaping the future of retail where our values drive every action. We stay close to customers and colleagues, always curious and connected. Our decisions are bold, our actions ambitious. Transparency is paramount, with straightforward, honest communication. We're constantly innovating, always striving for the best. Our focus is on aiming higher and winning together, combined with wise financial decisions to secure our future. Join us at M&S to shape the future of retail.
Loading...
MS Similar Companies
Grupo Carrefour Brasil
Reunimos uma equipe com mais de 70.000 colaboradores que representam a diversidade deste país. Hoje, somos um dos maiores empregadores do Brasil. Junto com os nossos fornecedores e parceiros, estamos comprometidos em satisfazer e encantar os consumidores todos os dias, construindo a nossa história c
AutoZone is the nation's leading retailer and a leading distributor of automotive replacement parts and accessories with more than 7,000 stores in the US, Mexico, Brazil and Puerto Rico. Each store carries an extensive line for cars, sport utility vehicles, vans and light trucks, including new and r
Türkiye'de modern perakende sektörünün öncülüğünü yapmakta olan Migros günümüzde çok geniş kullanım alanına sahip mağazalarında, gıda ve ihtiyaç maddelerinin yanı sıra kırtasiye, züccaciye, beyaz eşya, kitap ve konfeksiyon gibi bölümleriyle hemen hemen tüm müşteri gereksinimlerini karşılamaktadır.
REWE Group
The cooperatively organized REWE Group is one of the leading trade and tourism groups in Germany and Europe. In 2023, the company generated a total external turnover of more than 92 billion euros. Founded in 1927, REWE Group operates with around 390,000 employees in 21 European countries. The sa
H-E-B
H-E-B is headquartered in San Antonio, Texas with approximately $32 billion in revenue and 117,000+ Partners. Founded in 1905, H-E-B operates more than 400 stores in a number of formats, including superstores, supermarkets and gourmet markets. H-E-B is the #1 food retailer in the Austin, San Antoni
DMart - Avenue Supermarts Ltd
“DMart is a one-stop supermarket chain that aims to offer customers a wide range of basic home and personal products under one roof. Each DMart store stocks home utility products - including food, toiletries, beauty products, garments, kitchenware, bed and bath linen, home appliances and more - avai
Ahold Delhaize
Ahold Delhaize is one of the world’s largest food retail groups, we are a leader in supermarkets and e-commerce, and a company at the forefront of sustainable retailing. Our local brands employ around 393,000 associates in around 9,400 local grocery, small format, and specialty stores. Our family
Michaels Stores
At The Michaels Companies Inc, our purpose is to fuel the joy of creativity. As the leading creative destination in North America, we operate over 1,300 stores in 49 states and Canada and online at Michaels.com and Michaels.ca. The Michaels Companies, Inc. also owns Artistree, a manufacturer of cust
Morrisons
Our team of friendly faces works as one to provide shopping trips and a career experience you won’t find anywhere else. Together we work the Morrisons way. Constantly looking to do things even better, we work in partnership with our communities, colleagues, suppliers and British farmers to provide
.png)
MS CyberSecurity News
November 17, 2025 09:28 AM
Ex-M&S tech chief Higham joins cybersecurity firm
Ex-M&S tech chief Higham joins cybersecurity firm. Rachel Higham, who has also worked at WPP and BT, is a special advisor and consultant.
November 05, 2025 08:00 AM
M&S takes €154m profit hit from cyber attack
Marks and Spencer has said it will take a £136 million (€154 million) hit to its annual profits from a cyber attack that caused havoc with...
November 05, 2025 08:00 AM
M&S profits tank as supermarket reveals cost of its cyber attack
Profits at the supermarket M&S plummeted in the firm's latest results as it revealed the cost of a recent high-profile cyber attack.
November 05, 2025 05:46 AM
Marks&Spencer Faces £12M Loss Amid Cybersecurity Breach in First Half
Despite a significant cyberattack in late May, the retail titan closed the first half with a 22.5% increase in global sales.
October 31, 2025 07:00 AM
How Did M&S’ Cyber Attack Cost £300m and Help Next?
M&S' April 2025 cyber attack disrupted online operations and in-store services, causing an estimated £300m revenue loss while rival Next...
October 30, 2025 06:27 PM
M&S Cyber Attack Boosts Profits of Rival Retailer Next
As retailer Next reports increased profits after the M&S cyberattack, the biggest risk isn't the breach but the risk of losing ground to...
October 30, 2025 01:39 PM
M&S Cyberattack: Next’s Profits Expose the Real Breach Cost
As retailer Next reports increased profits after the M&S cyberattack, the biggest risk isn't the breach but the risk of losing ground to...
October 30, 2025 11:14 AM
Marks & Spencer News Today: Fashion Pivot Aims to Recover Post-Cyber Attack
Marks & Spencer, a major player in the UK retail sector, is navigating a challenging phase following a recent cybersecurity breach.
October 29, 2025 07:00 AM
M&S ends contract with TCS after cyberattack, claims report; TCS issues clarification: We do not provide
TCS has refuted a recent report alleging that leading British retail company Marks & Spencer (M&S) has ended contact with the IT firm over a...
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
MS CyberSecurity History Information
Official Website of Marks and Spencer
The official website of Marks and Spencer is https://jobs.marksandspencer.com/.
Marks and Spencer’s AI-Generated Cybersecurity Score
According to Rankiteo, Marks and Spencer’s AI-generated cybersecurity score is 100, reflecting their Critical security posture.
How many security badges does Marks and Spencer’ have ?
According to Rankiteo, Marks and Spencer currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
Does Marks and Spencer have SOC 2 Type 1 certification ?
According to Rankiteo, Marks and Spencer is not certified under SOC 2 Type 1.
Does Marks and Spencer have SOC 2 Type 2 certification ?
According to Rankiteo, Marks and Spencer does not hold a SOC 2 Type 2 certification.
Does Marks and Spencer comply with GDPR ?
According to Rankiteo, Marks and Spencer is not listed as GDPR compliant.
Does Marks and Spencer have PCI DSS certification ?
According to Rankiteo, Marks and Spencer does not currently maintain PCI DSS compliance.
Does Marks and Spencer comply with HIPAA ?
According to Rankiteo, Marks and Spencer is not compliant with HIPAA regulations.
Does Marks and Spencer have ISO 27001 certification ?
According to Rankiteo,Marks and Spencer is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Industry Classification of Marks and Spencer
Marks and Spencer operates primarily in the Retail industry.
Number of Employees at Marks and Spencer
Marks and Spencer employs approximately 39,274 people worldwide.
Subsidiaries Owned by Marks and Spencer
Marks and Spencer presently has no subsidiaries across any sectors.
Marks and Spencer’s LinkedIn Followers
Marks and Spencer’s official LinkedIn profile has approximately 686,846 followers.
NAICS Classification of Marks and Spencer
Marks and Spencer is classified under the NAICS code 43, which corresponds to Retail Trade.
Marks and Spencer’s Presence on Crunchbase
Yes, Marks and Spencer has an official profile on Crunchbase, which can be accessed here: https://www.crunchbase.com/organization/marks-spencer.
Marks and Spencer’s Presence on LinkedIn
Yes, Marks and Spencer maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/marks-and-spencer.
Cybersecurity Incidents Involving Marks and Spencer
As of November 27, 2025, Rankiteo reports that Marks and Spencer has experienced 30 cybersecurity incidents.
Number of Peer and Competitor Companies
Marks and Spencer has an estimated 15,251 peer or competitor companies worldwide.
What types of cybersecurity incidents have occurred at Marks and Spencer ?
Incident Types: The types of cybersecurity incidents that have occurred include Breach, Cyber Attack and Ransomware.
What was the total financial impact of these incidents on Marks and Spencer ?
Total Financial Loss: The total financial loss from these incidents is estimated to be $67.26 billion.
How does Marks and Spencer detect and respond to cybersecurity incidents ?
Detection and Response: The company detects and responds to cybersecurity incidents through an remediation measures with restore encrypted virtual machines, remediation measures with sanitize systems, and network segmentation with need for stronger network segmentation, and enhanced monitoring with faster ransomware detection capabilities, and containment measures with disabled online shopping orders, containment measures with disabled click and collect, containment measures with disabled contactless payments in some stores, and communication strategy with letter to customers, and law enforcement notified with yes, and communication strategy with affected customers were notified, and third party assistance with tata consultancy services, and and containment measures with shut down systems to prevent further spread, and recovery measures with recovery efforts ongoing, recovery measures with full recovery expected by october or november 2025, and communication strategy with calling for greater transparency and cyberattack reporting, and third party assistance with professional intermediaries, and containment measures with shutting down systems, and remediation measures with rebuilding systems, and recovery measures with bringing systems back up securely, and communication strategy with media channels, including bbc, and network segmentation with not heavily segmented, and law enforcement notified with yes, and and enhanced monitoring with strong identity verification, enhanced monitoring with vmware hardening, enhanced monitoring with backup integrity, enhanced monitoring with continuous monitoring, and and organizations involved with ['uk national cyber security centre (ncsc)'], and and remediation measures with password resets for affected customers, and customer notification with letters sent to affected customers, public statement with issued to media and on company channels, advisory with no action required by customers except password reset on next login, and incident response plan activated with yes (systems taken offline as precaution), and third party assistance with yes (cybersecurity experts engaged by harrods), and law enforcement notified with yes (metropolitan police and ncsc investigating), and containment measures with online orders suspended, containment measures with job listings removed, containment measures with affected systems isolated, and communication strategy with initial public disclosure (2024-04-21), communication strategy with limited updates (last statement on 2024-04-25), communication strategy with harrods assured customers of normal operations, and incident response plan activated with yes (all three retailers), and third party assistance with ncsc (assisting m&s and co-op), third party assistance with national crime agency (nca) and metropolitan police cybercrime unit (m&s investigation), and law enforcement notified with yes (metropolitan police and nca for m&s), and containment measures with harrods: restricted internet access, shut down some systems, containment measures with m&s: halted online orders, paused hiring/recruitment systems, containment measures with co-op: shut down internal systems, staff warnings for online conferencing, and recovery measures with m&s: working to restore online shop and recruitment systems, and communication strategy with harrods: public statement (no customer action required), communication strategy with m&s: updates on job site ('working hard to be back online'), communication strategy with co-op: internal staff warnings, and remediation measures with urgent calls for security countermeasures in smart buildings, remediation measures with replacement of outdated systems (e.g., windows 7), and communication strategy with public disclosure via rics report, communication strategy with media coverage (the guardian), and containment measures with restricted internet access (harrods), containment measures with it systems taken down (co-op), and enhanced monitoring with security teams advised to deploy endpoint protection software, and incident response plan activated with yes (m&s, harrods, co-op), and third party assistance with likely (m&s, co-op for forensic investigation), and containment measures with restricted internal it systems, paused internet access (harrods), containment measures with shut down parts of it systems (co-op), containment measures with suspended online orders (m&s), and remediation measures with partial restoration of online services (m&s), and recovery measures with ongoing (m&s), recovery measures with quick recovery (h&m, harrods), and communication strategy with public disclosures (all), communication strategy with customer apologies (h&m, m&s), and incident response plan activated with yes (co-op: proactive steps), incident response plan activated with yes (m&s: systems taken offline), and third party assistance with national cyber security centre (ncsc), third party assistance with national crime agency (nca), third party assistance with metropolitan police cyber crime unit, and law enforcement notified with yes (m&s: metropolitan police investigating), law enforcement notified with likely (co-op: not explicitly stated), and containment measures with shut down back-office/call center systems (co-op), containment measures with offline systems (m&s), and recovery measures with working to reduce disruption (co-op), and communication strategy with public statements (both companies), and and third party assistance with national cyber security centre (ncsc), third party assistance with fbi, third party assistance with national crime agency, third party assistance with metropolitan police, third party assistance with ransomware specialists (unspecified), and and containment measures with isolation of affected systems, containment measures with shutdown of online store, containment measures with reliance on pen-and-paper processes, and remediation measures with ongoing rebuild of systems, remediation measures with collaboration with law enforcement, and recovery measures with expected full online operations by end of month (post-attack), recovery measures with insurance claim of >£100m, and communication strategy with transparency with mps during subcommittee hearing, communication strategy with no public disclosure of ransom interactions, and enhanced monitoring with invested hundreds of millions in cybersecurity pre-attack, enhanced monitoring with expanded prevention team to 80 staff, and containment measures with network segmentation (recommended), containment measures with isolation of affected systems (recommended), and remediation measures with centralized log management, remediation measures with real-time threat detection, remediation measures with patch/vulnerability management, remediation measures with identity and access control reforms (mfa, least privilege), and recovery measures with immutable backups (recommended), recovery measures with system restoration protocols, and communication strategy with transparency in public disclosures (recommended), communication strategy with stakeholder/regulator notifications, and and and incident response plan activated with yes (though details undisclosed), and containment measures with suspension of online orders, containment measures with partial halt of click-and-collect services, containment measures with isolation of compromised systems (presumed), and remediation measures with contract termination with tcs for help-desk services, remediation measures with review of third-party access controls, remediation measures with enhanced authentication for vendor logins (presumed), and recovery measures with restoration of online shopping platform, recovery measures with rebuilding supply chain operations, recovery measures with customer communication campaigns, and communication strategy with public disclosure of incident, communication strategy with statements to mps (uk parliament), communication strategy with investor updates, communication strategy with media responses, and enhanced monitoring with likely (though not explicitly stated), and incident response plan activated with likely (marks and spencer ceo initiated communications; incident response retainers mentioned as best practice), and third party assistance with cloud backup providers (e.g., amazon, google, microsoft), third party assistance with specialist third-party backup services, third party assistance with incident response retainers, and remediation measures with ceo-led transparent communication, remediation measures with cloud backups for data recovery, remediation measures with employee training on deepfake/phishing, and recovery measures with prioritization of critical applications (e.g., payroll, supplier payments), recovery measures with third-party support for restoration, and communication strategy with timely digital communications by ceo (marks and spencer), communication strategy with transparency with regulators/investors, and enhanced monitoring with early detection technologies for threat identification, and network segmentation with recommended as a defense measure, and enhanced monitoring with recommended for unusual access to shared resources, and incident response plan activated with yes (implied by recovery efforts), and containment measures with restoration of shops and websites to normal operations, and remediation measures with accelerated investment in cybersecurity technology, remediation measures with supply chain improvements, remediation measures with store updates, and recovery measures with marketing campaigns for autumn/winter ranges, recovery measures with product innovation (especially in food), recovery measures with ocado joint venture optimization, and communication strategy with public disclosure via half-year results (nov 5, 2025), communication strategy with media statements on recovery plans, and enhanced monitoring with planned (part of cybersecurity investment), and and communication strategy with public advisories (e.g., ncsc warnings on fraud trends), and enhanced monitoring with recommended (continuous assurance for drift detection), and and third party assistance with u.k. national cyber security centre (ncsc), and and remediation measures with password reset prompts for customers, remediation measures with customer advisories on online safety, and communication strategy with trading update from ceo stuart machin, communication strategy with customer note from operations director jayne wall, communication strategy with faq page for affected customers, and and status with uk police investigating (as part of broader retail cyberattacks), details with none, and containment measures with pausing online shopping, containment measures with manual logistics processes, and planned with ['restart and ramp up online operations (june–july 2024)', 'upgrade infrastructure and network connectivity', 'enhance store/colleague technology', 'improve supply chain systems'], status with ongoing (accelerated investment phase), and public statements with ['london stock exchange filing (wednesday)', 'customer advisories (data compromise warning)'], transparency with partial (no confirmation/denial of ransom payment)..
Incident Details
Can you provide details on each incident ?
Title: Ransomware Attack on Marks & Spencer
Description: A coordinated ransomware campaign by the DragonForce group infiltrated Marks & Spencer’s IT environment, deploying its encryptor on VMware ESXi hosts that supported critical e-commerce and payment platforms.
Type: Ransomware
Attack Vector: Encryptor deployed on VMware ESXi hosts
Threat Actor: DragonForce group
Motivation: Financial
Title: Marks and Spencer Data Breach and Ransomware Attack
Description: Marks and Spencer (M&S) has confirmed that customer information has been taken following a cyberattack. The attack has caused significant disruption, with online orders still affected weeks later. In a letter to customers, the retail giant revealed that personally identifiable information (PII) has been stolen by cybercriminals. This forced the firm to disable online shopping orders, click and collect, and contactless payments in some stores. The incident, which seems to have been a ransomware attack, took systems offline and caused undeniable disruption to the retailer’s operation.
Type: Ransomware Attack
Title: Marks & Spencer Cyberattack
Description: Marks & Spencer, a British retail chain, revealed on Tuesday that some of its customers' personal data had been stolen in a cyberattack. The incident was sophisticated and led to the suspension of online sales and contactless payments. The company emphasized that no payment details or passwords were compromised. Affected customers were notified, but the exact number was not disclosed. The company assured that no further action was necessary beyond resetting passwords. There is no indication that the stolen data has been shared. M&S reported the incident to relevant authorities and law enforcement and continues to collaborate with them.
Date Publicly Disclosed: Tuesday
Type: Data Breach
Attack Vector: Cyberattack
Title: M&S Cyberattack
Description: M&S reported a cyberattack that disrupted its online services for more than three weeks. The attack, believed to be linked to the hacking group 'Scattered Spider,' resulted in the compromise of certain customer data.
Type: Cyberattack
Threat Actor: Scattered Spider
Title: Cyberattack on Marks & Spencer
Description: British retailer giant Marks & Spencer (M&S) is bracing for a potential profit hit of up to £300 million following a recent cyberattack that led to widespread operational and sales disruptions.
Date Detected: April 2023
Date Publicly Disclosed: Wednesday (specific date not provided)
Type: Ransomware
Attack Vector: DragonForce encryptor on VMware ESXi hosts
Threat Actor: Scattered Spider
Motivation: Financial gain, disruption of operations
Title: Marks and Spencer Cyberattack
Description: Marks and Spencer (M&S) experienced a major cyberattack on April 22, 2025. The attackers compromised workers at Tata Consultancy Services (TCS), a third-party supplier, to gain access to M&S systems. The attack resulted in the theft of customer data, including home addresses, phone numbers, and dates of birth, but no passwords or payment details were compromised. The DragonForce hacking collective claimed responsibility and demanded a ransom. M&S forecasted a loss of around £300 million in operating profit.
Date Detected: April 22, 2025
Type: Cyberattack
Attack Vector: Compromised third-party supplier
Vulnerability Exploited: Human element
Threat Actor: DragonForce hacking collective
Motivation: Financial gain
Title: M&S Ransomware Attack by DragonForce
Description: M&S experienced a ransomware attack attributed to DragonForce, involving social engineering and double extortion.
Type: Ransomware
Attack Vector: Social EngineeringPhishing
Vulnerability Exploited: Password Reset Mechanism
Threat Actor: DragonForce
Motivation: Financial Gain
Title: Ransomware Attack on Marks & Spencer (M&S)
Description: Marks & Spencer (M&S) experienced a ransomware attack in April, linked to the Scattered Spider hacking collective using DragonForce ransomware infrastructure. The attack was sophisticated and involved social engineering through a third party, Tata Consultancy Services (TCS). M&S had to shut down large parts of its systems to prevent further damage, affecting online shopping and other areas.
Date Detected: 2023-04-17
Date Publicly Disclosed: 2023-07-08
Type: Ransomware
Attack Vector: Social EngineeringCompromised Credentials
Vulnerability Exploited: Compromised credentials from a third party (TCS)
Threat Actor: Scattered Spider (DragonForce)
Motivation: Ransom and extortion
Title: Cyber Attack on Marks and Spencer
Description: A ransomware attack on retailer Marks and Spencer in the UK in April last year caused a significant loss in revenues, with a £300 million ($403 million) operating profit loss, as its online business was taken offline for seven weeks.
Date Detected: February 2024
Type: Ransomware
Attack Vector: Phishing, Impersonation
Vulnerability Exploited: Unauthorized system access via help desk
Threat Actor: DragonForce ransomware group
Motivation: Financial gain
Title: Surge in Ransomware Attacks on Retail Sector in Q2 2025
Description: Publicly disclosed ransomware attacks targeting the retail sector globally have surged by 58% in Q2 2025 compared to Q1, with UK-based firms bearing the brunt of this targeting.
Date Publicly Disclosed: 2025-07-16
Type: Ransomware
Threat Actor: Scattered Spider
Motivation: ExtortionData Theft
Title: UK Government Plans to Ban Ransom Payments for Public Sector and Critical Infrastructure
Description: The UK government is proposing legislation to ban public sector and critical infrastructure organizations from paying ransoms after ransomware attacks. This includes local councils, schools, and the NHS. The ban aims to disrupt the business model of cybercriminals and reduce the attractiveness of these organizations as targets. Additionally, businesses not covered by the ban will be required to notify the government if they intend to make a ransom payment, and a mandatory reporting system is being developed.
Type: Ransomware
Attack Vector: Ransomware
Threat Actor: Cybercriminal groupsMany based in Russia
Motivation: Financial gain
Title: Scattered Spider Cyber Campaign
Description: A highly aggressive cyber campaign identified in mid-2025 by Google’s Threat Intelligence Group (GTIG), targeting major industries including retail, airlines, and insurance. The campaign is attributed to Scattered Spider, a financially motivated hacking group also known as 0ktapus and UNC3944.
Date Detected: mid-2025
Type: Ransomware, Data Theft
Attack Vector: Phone-based social engineering, Compromised Active Directory accounts, VMware vSphere environments
Vulnerability Exploited: Weak identity verification procedures in IT help desks
Threat Actor: Scattered Spider (0ktapus, UNC3944)
Motivation: Financial
Title: Marks and Spencer (M&S) Cyberattack and Data Breach
Description: British retailer Marks and Spencer (M&S) announced a cyberattack that compromised customer personal data, including names, home addresses, email addresses, and phone numbers. The incident caused operational disruptions, including unavailability of online shopping and empty shelves in physical stores. The attack was claimed by the DragonForce ransomware group, though this remains unconfirmed. The UK's National Cyber Security Centre (NCSC) is investigating potential links to similar attacks on Co-op and Harrods.
Date Detected: 2024-04
Date Publicly Disclosed: 2024-05-28
Type: Data Breach
Threat Actor: Claimed By: DragonForce ransomware group
Title: Cyber Attacks on UK Retailers Including M&S, Co-op, Cartier, Harrods, and LVMH
Description: A series of cyber attacks targeted major UK retailers and luxury brands in 2024, including M&S, Co-op, Cartier, Harrods, and LVMH. The attacks, attributed in part to the cybercriminal group ScatteredSpider, resulted in significant financial losses, with M&S alone reporting a £300 million profit loss. Over half of UK businesses have experienced cyber attacks in the past three years, incurring a collective £64 billion in direct and indirect costs. The evolving threat landscape, driven by AI, nation-state actors, and Cybercrime-as-a-Service (CaaS), underscores the need for proactive cybersecurity measures.
Type: Cyber Attack
Attack Vector: AI-driven attacksCybercrime-as-a-Service (CaaS)RansomwarePhishingSupply Chain Compromise
Threat Actor: ScatteredSpiderHostile nation-statesCybercriminal groups
Motivation: Financial gainDisruptionData theft
Title: Ransomware Attack on Marks & Spencer and Harrods by Scattered Spider
Description: British retail giants Marks & Spencer (M&S) and Harrods were targeted in a cyberattack linked to the hacking group Scattered Spider (Octo Tempest). The attack disrupted M&S's online orders, contactless payments, click-and-collect services, and supply chain operations, leading to empty shelves, paused recruitment, and significant financial losses. Harrods confirmed a cyberattack but stated operations remained normal. The UK's Metropolitan Police and National Cyber Security Centre (NCSC) are investigating. The attack is suspected to involve the DragonForce ransomware strain, deployed via phishing, SIM swapping, and MFA fatigue techniques.
Date Detected: 2024-04-21
Date Publicly Disclosed: 2024-04-21
Type: Ransomware
Attack Vector: PhishingSIM SwappingMulti-Factor Authentication (MFA) Fatigue
Threat Actor: Scattered Spider (Octo Tempest)
Motivation: Financial Gain (Ransomware)
Title: Cyber-Attack on Harrods, Marks & Spencer (M&S), and Co-op
Description: Harrods, Marks & Spencer (M&S), and Co-op were targeted in separate but potentially linked cyber-attacks. Harrods shut down some systems but continued operations in stores and online. M&S suffered significant disruptions, including a £650m drop in stock market value, halted online orders, gaps in store shelves, and paused hiring due to compromised recruitment systems. Co-op also shut down some internal systems and warned staff about online conferencing security. The attacks may exploit vulnerabilities in shared systems like SAP. The National Cyber Security Centre (NCSC) and law enforcement are investigating potential links between the incidents.
Date Detected: Early in the week (exact date unspecified, likely late April/early May 2024 based on context)
Date Publicly Disclosed: 2024-05-02 (Harrods statement; M&S and Co-op incidents disclosed earlier in the week)
Type: Unauthorized Access Attempt
Vulnerability Exploited: Potential SAP system vulnerabilities (shared by M&S and Co-op)
Threat Actor: Scattered Spider (linked to M&S attack)Unidentified actors for Harrods and Co-op
Title: Cyber-Attack Disrupts UK Businesses, Including Marks & Spencer Website Outage
Description: A report by the Royal Institution of Chartered Surveyors (Rics) reveals that 27% of UK businesses experienced a cyber-attack in the last 12 months, up from 16% the previous year. The attacks targeted critical infrastructure, building management systems, and operational technology, with outdated operating systems (e.g., Windows 7) exacerbating vulnerabilities. Marks & Spencer suffered a major attack in April, halting online orders for nearly seven weeks and causing a 20% drop in clothing sales over four weeks. The report warns of growing risks due to AI advancements and outdated technologies in smart buildings.
Date Publicly Disclosed: 2024-06-10T00:00:00Z
Type: Cyber-Attack
Attack Vector: Exploitation of Outdated Systems (e.g., Windows 7)Building Management Systems (BMS)IoT DevicesCCTV NetworksAccess Control SystemsAutomated HVAC/Lighting
Vulnerability Exploited: Unpatched Software (e.g., Windows 7 EOL)Weak Security in Operational Technology (OT)Lack of Network SegmentationInsufficient Monitoring
Motivation: Financial GainDisruption of Business OperationsExploitation of Smart Building Vulnerabilities
Title: Cyberattacks on British Retailers: Harrods, Marks & Spencer, and Co-Op Targeted in Suspected Ransomware Campaign
Description: Three major British retailers—Harrods, Marks & Spencer (M&S), and Co-Op—have been hit by cyberattacks in quick succession. The M&S incident is allegedly linked to the ScatteredSpider ransomware group, causing widespread outages in stores and online platforms. Harrods restricted internet access at its sites following an attempt to gain unauthorized access, while Co-Op took down parts of its IT systems proactively. The attacks highlight the vulnerability of the retail sector, with high downtime costs and potential revenue losses (e.g., M&S's share price dropped 7%, resulting in millions in lost sales). Security experts warn of rising threats due to AI-enabled social engineering and adaptive malware, urging retailers to implement robust incident response plans, endpoint protection, and staff training.
Type: Cyberattack
Attack Vector: Social EngineeringUnauthorized System AccessPotential Ransomware
Threat Actor: ScatteredSpider (alleged for M&S)
Motivation: Financial GainDisruption of Operations
Title: Series of Cyber Attacks on UK Retailers (April–June 2024)
Description: A wave of cyber attacks targeted major UK retailers, including Marks and Spencer (M&S), the Co-operative Group, Harrods, Adidas, and H&M, between April and June 2024. The attacks disrupted ecommerce, payments processing, and in-store operations, with some incidents linked to the DragonForce ransomware-as-a-service group. The financial and reputational impacts were severe, with M&S alone losing £300m in market value. Retailers' large organizational footprints and customer data made them prime targets, exacerbated by vulnerabilities in smart building systems and IoT devices.
Date Detected: 2024-04-01 (M&S, Easter weekend)2024-05-01 (Harrods)2024-05-XX (Adidas)2024-04-XX (Co-operative Group)2024-06-XX (H&M, early June)
Date Publicly Disclosed: 2024-04-XX (M&S, post-Easter)2024-05-01 (Harrods)2024-05-XX (Adidas)2024-04-XX (Co-operative Group)2024-06-XX (H&M, not officially confirmed as cyber attack)
Date Resolved: ['2024-06-XX (M&S, partial recovery ongoing)', None, None, None, '2024-06-XX (H&M, within 2 hours for most stores)']
Type: Ransomware (M&S)
Attack Vector: Third-party customer-service provider (Adidas)Unauthorised access attempt (Harrods)Ransomware (M&S, linked to DragonForce RaaS)Potential exploitation of smart building systems/IoT (speculative for H&M/Co-op)Unguarded network sockets or physical access (theoretical, per RICS)
Vulnerability Exploited: Third-party vendor security (Adidas)Smart building systems (IoT, access control, CCTV, HVAC) (theoretical)
Threat Actor: DragonForce (suspected for M&S and possibly others)
Motivation: Financial gain (ransomware, data theft)Disruption (operational impact)Data exfiltration (customer PII)
Title: Cyber Attack on Co-op Group and Ongoing Ransomware Incident at Marks & Spencer (M&S)
Description: Britain’s Co-op Group disclosed a hacking attempt on its systems, marking the second high-profile cyber attack on a major UK retailer in recent weeks, following an ongoing ransomware-related incident at Marks & Spencer (M&S). The Co-op shut down some back-office and call center operations but confirmed that stores, online operations, and funeral homes remained operational. The M&S attack, attributed to the 'Scattered Spider' hacking collective using the DragonForce encryptor, disrupted clothing/home orders and some food product availability. The group is known for aggressive tactics, including phishing, MFA bombing, and SIM swapping. UK authorities, including the NCSC, NCA, and Metropolitan Police, are investigating both incidents.
Date Publicly Disclosed: 2024-06-19
Type: Unauthorized Access Attempt
Attack Vector: PhishingMFA BombingSIM SwappingExploitation of IT Help Desks
Threat Actor: Scattered Spider (alleged for M&S)
Motivation: Financial Gain (ransomware)
Title: Marks & Spencer Ransomware Attack Highlights Backup Strategy Flaws
Description: Major UK retailer Marks & Spencer (M&S) was recently hit by a ransomware attack that disrupted internal systems and locked employees out of critical files. The incident underscores broader trends in cybercriminals targeting large organizations with ransomware, demanding payment to restore access. The attack could have been mitigated with isolated backups, though such 'unhackable' solutions (e.g., HyperBUNKER’s diode-based offline vault) introduce financial and logistical challenges. Traditional backup failures in similar cases (e.g., Capital Health, NHS) raise questions about the practicality of offline storage as a universal safeguard.
Type: ransomware
Vulnerability Exploited: lack of isolated backupspotential network protocol/handshake exploits (historical context)
Motivation: financial gain (ransom demand)disruption of operations
Title: Ransomware Attack on Marks & Spencer (M&S)
Description: A sophisticated ransomware attack on Marks & Spencer (M&S) forced the closure of its online store for nearly seven weeks. The attack, attributed to the DragonForce ransomware group and linked to the Scattered Spider hacking collective, involved impersonation and a third-party contractor. M&S reported the incident to the UK's National Cyber Security Centre (NCSC) and collaborated with law enforcement, including the FBI, National Crime Agency, and Metropolitan Police. The attack disrupted operations at M&S's key online clothing distribution center in Castle Donington, Leicestershire, causing significant financial and operational impact. M&S had invested heavily in cybersecurity prior to the attack but acknowledged the difficulty of preventing determined threat actors in large organizations with many workers and contractors.
Date Detected: 2024-04-19
Type: ransomware
Attack Vector: impersonationthird-party contractor compromisesophisticated intrusion
Threat Actor: DragonForce (ransomware group)Scattered Spider (hacking collective)
Motivation: financial gain (ransom demand)disruption
Title: 2025 Retail Cyberattacks: Marks & Spencer, Co-op, and Louis Vuitton Breaches
Description: In 2025, targeted cyberattacks disrupted major retail brands, including Marks & Spencer (ransomware, payment system disruption, and third-party exploitation), Co-op (6.5 million customer records exposed), and Louis Vuitton (early-stage breach with potential data exposure and brand trust threats). These incidents highlight vulnerabilities in identity, access, and infrastructure visibility, emphasizing the need for proactive monitoring, centralized log management, and Zero Trust principles to mitigate operational downtime, financial loss, and reputational damage.
Type: Data Breach
Attack Vector: Stolen Credentials (Third-Party Vendors)Unmonitored EndpointsAPI ExploitationPoorly Secured User AccountsPhishing/Social Engineering (Potential)Known Vulnerabilities (Unpatched Systems)
Vulnerability Exploited: Identity and Access Control WeaknessesLack of Centralized Log ManagementUnsegmented NetworksUnmonitored API TrafficDelayed Patch Management
Motivation: Financial Gain (Ransomware)Data Theft (Customer Records)Disruption of Operations
Title: Marks & Spencer (M&S) Cyberattack via Third-Party Vendor (TCS) Leading to £300M Loss and Contract Termination
Description: British retail giant Marks & Spencer (M&S) suffered a high-profile cyberattack in April 2025, exploited through a third-party vendor (Tata Consultancy Services - TCS). The attack, attributed to the Scattered Spider group, used sophisticated impersonation of TCS help-desk staff to gain access to M&S systems. The breach disrupted M&S's digital infrastructure, halted online shopping, and caused supply chain disruptions, resulting in an estimated £300M in financial losses and over £1B wiped from market capitalization. M&S subsequently terminated its help-desk contract with TCS in July 2025, though both companies maintain the decision was unrelated to the breach. The incident highlights risks in third-party vendor access, social engineering, and outsourcing ecosystems in cybersecurity.
Date Detected: 2025-04
Date Publicly Disclosed: 2025-04
Type: Cyberattack
Attack Vector: Sophisticated ImpersonationThird-Party Vendor Compromise (TCS Help-Desk Access)Credential Theft
Vulnerability Exploited: Human Trust in Help-Desk ProcessesWeak Authentication for Third-Party AccessLack of Multi-Factor Authentication (MFA) for Vendor Logins
Threat Actor: Scattered Spider
Motivation: Financial GainDisruptionData Theft (Presumed)
Title: Cybersecurity Breach Involving Marks and Spencer (2024) and Scattered Spider Attacks (2023-2024)
Description: Scattered Spider, an organized cybercriminal group, conducted high-profile attacks across multiple industries, including two US casinos (2023), Transport for London (2023), and Marks and Spencer (2024). The incidents highlight evolving attack vectors, including deepfake fraud (e.g., a Hong Kong finance worker tricked into transferring $25M in 2023) and ransomware. The Marks and Spencer breach involved timely CEO communications to mitigate reputational damage. The article emphasizes the need for proactive cyber resilience, holistic impact assessment, operational continuity planning, and board-level accountability in cybersecurity strategies.
Type: Cyber Attack
Attack Vector: PhishingDeepfake ImpersonationRansomwareSocial EngineeringExploitation of Human Weaknesses
Vulnerability Exploited: Human ErrorLack of Multi-Factor Authentication (MFA)Insufficient Employee TrainingWeak Access Controls
Threat Actor: Scattered SpiderUnidentified Fraudsters (Hong Kong Deepfake Case)
Motivation: Financial GainData TheftReputation Damage
Title: DragonForce Ransomware Cartel Emerges from Conti’s Leaked Source Code
Description: A new ransomware operation, DragonForce, built on Conti’s leaked source code, has surfaced with cartel-like ambitions in the cybercrime ecosystem. The group retains Conti’s core encryption behavior and network-spreading capabilities, conducting coordinated attacks and recruiting affiliates via a shared platform. DragonForce has shifted from a ransomware-as-a-service (RaaS) model to a self-styled cartel structure, encouraging affiliates to create branded variants. Recent campaigns include threats to delete decryptors and leak data on September 2 and September 22, 2024. The ransomware encrypts local storage and network shares via SMB, using ChaCha20 and RSA encryption with unique per-file keys and a 10-byte metadata block. Affiliates like Devman and partnerships with groups like Scattered Spider (linked to BlackCat, Ransomhub, and Qilin) highlight its expanding influence. Aggressive tactics include defacing rival leak sites (e.g., BlackLock) and attempting server takeovers (e.g., Ransomhub).
Type: ransomware
Attack Vector: SMB (Server Message Block) exploitationlateral movement via network sharesrecruitment of affiliates for branded variantspartnerships with initial access brokers (e.g., Scattered Spider)
Threat Actor: DragonForceDevman (affiliate)Scattered Spider (partner)
Motivation: financial gaindominance in ransomware ecosystemrecruitment of affiliatesdisruption of rival groups
Title: Marks & Spencer Cyber-Attack Impacting H1 2025 Earnings
Description: Marks & Spencer suffered a catastrophic cyber-attack during summer 2025, leading to a 55.4% drop in adjusted pre-tax profit (from £413.1m in H1 2024 to £184.1m in H1 2025). The attack disrupted stock availability, online transactions, and customer trust, causing shoppers to switch to rivals like Next. While sales grew by 22.1% (£7,965.2m in H1 2025 vs. £6,524.3m in H1 2024), profitability was severely impacted. The company received a £100m insurance payout but faces long-term challenges in customer retention, supply chain recovery, and cybersecurity upgrades. Food sales remained strong, but clothing recovery lagged. The incident occurred during a peak summer shopping period, exacerbating losses.
Date Publicly Disclosed: 2025-11-05
Type: Cyber Attack
Motivation: Financial GainDisruption
Title: Analysis of Cybersecurity Incidents in UK Retail Sector (Q3 2024–Q2 2025) and Holiday Season Threats
Description: Huntsman Security analyzed 1,381 data security incidents reported to the UK's ICO by the retail and manufacturing sector between Q3 2024 and Q2 2025, finding minor seasonal peaks with no significant outliers. Key threats included brute force attacks, misconfigurations, malware, phishing, and ransomware. While some experts downplayed seasonal spikes, others warned of heightened ransomware risks during holidays (e.g., Thanksgiving, Christmas) and a surge in fake e-commerce sites targeting consumers. Notable incidents included ransomware breaches at M&S and the Co-Op Group in Q2 2025, causing operational disruptions like empty shelves. Fraud losses during the 2024 festive season reached £11.8m, with AI-enabled scams (e.g., typosquatted domains, fake trust badges) and phishing campaigns impersonating brands like Amazon, Samsung, and Ray-Ban.
Date Publicly Disclosed: 2025-11-01
Type: Data Breach
Attack Vector: Brute ForceHardware/Software MisconfigurationMalwarePhishingRansomwareFake E-commerce Sites (Typosquatting)AI-Generated ScamsFake Package Tracking Messages
Threat Actor: Scattered Lapsus$ Hunters (alleged upcoming attacks under #ShinyHuntazz)Unspecified ransomware groups (e.g., M&S and Co-Op Group breaches)Fraudsters operating fake e-commerce sites
Motivation: Financial Gain (ransomware, fraud)Data Theft (customer databases)Opportunistic Exploitation (seasonal distractions)
Title: Marks and Spencer Data Breach (April 2024)
Description: Marks and Spencer Group notified customers that hackers accessed some of their data in an April cyberattack. The stolen information includes basic contact details, dates of birth, online order histories, and masked payment information (unusable). Customers are prompted to reset passwords. The attack disrupted online purchases and impacted store inventories. The cybercrime group Scattered Spider is linked to the attack, though DragonForce claimed credit.
Date Detected: 2024-04
Date Publicly Disclosed: 2024-05-28
Type: data breach
Threat Actor: Scattered SpiderDragonForce
Title: Marks & Spencer (M&S) Cyberattack and Ransomware Incident (April 2024)
Description: Marks & Spencer (M&S) suffered a cyberattack in April 2024, leading to significant operational disruptions, financial losses, and potential customer data compromise. The incident, attributed to the DragonForce ransomware group, disrupted M&S's app, online shopping, and supply chain operations, with effects expected to persist into July. The company anticipates a £300 million ($402 million) hit to annual profits, excluding direct incident-related costs. While M&S has not confirmed or denied paying a ransom, the attackers have not yet leaked the allegedly compromised data on their darknet site. The incident has prompted accelerated investments in infrastructure upgrades and supply chain systems.
Date Detected: 2024-04-01T00:00:00Z
Date Publicly Disclosed: 2024-04-03T00:00:00Z
Type: Cyberattack
Threat Actor: DragonForce (ransomware group)
Motivation: Financial GainExtortion
What are the most common types of attacks the company has faced ?
Common Attack Types: The most common types of attacks the company has faced is Ransomware.
How does the company identify the attack vectors used in incidents ?
Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Third-party supplier, Social Engineering, Compromised credentials from TCS, Help desk, Phone-based social engineering, PhishingSIM SwappingMFA Fatigue, Third-party vendor (Adidas)Potential physical access (unguarded sockets/IoT for others), IT help desks (via social engineering), third-party contractorimpersonation, Third-Party Vendors (Compromised Credentials)Unmonitored EndpointsAPI Exploitation, TCS help-desk staff credentials (impersonation/social engineering) and Phishing EmailsDeepfake Impersonation (Hong Kong Case).
Impact of the Incidents
What was the impact of each incident ?
Incident : Ransomware MAR1041050625
Financial Loss: £3.8 million daily
Systems Affected: VMware ESXi hostse-commerce platformspayment platforms
Downtime: 5 days
Operational Impact: Suspension of all online sales
Revenue Loss: £3.8 million daily
Brand Reputation Impact: Drop in market capitalization by over £500 million
Incident : Ransomware Attack MAR347051325
Data Compromised: Personally identifiable information (pii)
Systems Affected: Online shopping ordersClick and collectContactless payments
Downtime: ['Online orders affected for weeks']
Operational Impact: Significant disruptionSystems taken offline
Incident : Data Breach MAR528051425
Data Compromised: Personal Data
Systems Affected: Online SalesContactless Payments
Operational Impact: Suspension of online sales and contactless payments
Incident : Cyberattack MAR733051525
Data Compromised: Customer data
Systems Affected: Online services
Downtime: More than three weeks
Incident : Ransomware MAR356052125
Financial Loss: Up to £300 million ($402 million)
Data Compromised: Customer data
Systems Affected: Online retail systems, VMware ESXi hosts
Downtime: At least until July
Operational Impact: Widespread operational and sales disruptions
Incident : Cyberattack MAR900062025
Financial Loss: £300 million
Data Compromised: Home addresses, Phone numbers, Dates of birth
Incident : Ransomware MAR558070925
Data Compromised: Names, Birth dates, Addresses, Phone numbers, Household information, Order histories
Operational Impact: Delivery Disruptions
Incident : Ransomware MAR601070925
Systems Affected: Online shopping and other areas
Downtime: Significant
Operational Impact: Business impairing
Incident : Ransomware MAR847071225
Financial Loss: £300 million ($403 million)
Systems Affected: Virtual machinesContactless paymentsClick-and-collectOnline ordering
Downtime: Seven weeks
Operational Impact: Online business taken offline
Revenue Loss: £300 million ($403 million)
Incident : Ransomware MAR956072325
Financial Loss: Millions of pounds each year
Systems Affected: Local councilsSchoolsNHSBritish LibraryMarks & SpencerCo-opHarrods
Downtime: Significant impact on business operations at M&S stores
Operational Impact: Stopped accepting online ordersRestricted internet access
Incident : Ransomware, Data Theft MAR903072925
Data Compromised: Sensitive data, Active directory database
Systems Affected: VMware vSphere environmentsESXi hostsVCSA
Incident : Data Breach MAR451082725
Data Compromised: Names, Home addresses, Email addresses, Phone numbers
Systems Affected: Online shopping platformInventory managementProduct availability systems
Downtime: {'online_shopping': 'Ongoing (as of disclosure date)', 'in_store_operations': 'Partially disrupted (empty shelves, limited product availability)'}
Operational Impact: Severe (online shopping unavailable, in-store product shortages)
Customer Complaints: Likely (based on in-store apologies for technical issues)
Brand Reputation Impact: Moderate to High (public disclosure, operational disruptions, share price decline)
Identity Theft Risk: Low to Moderate (no payment details or passwords compromised, but PII exposed)
Payment Information Risk: None (M&S stated no usable payment or card details were held or compromised)
Incident : Cyber Attack MAR628082925
Financial Loss: £64 billion (collective UK businesses); £300 million (M&S alone)
Operational Impact: Significant disruption to business operations, particularly for SMEs
Revenue Loss: £300 million (M&S); £27 billion annual revenue loss potential for UK businesses without cybersecurity investment
Brand Reputation Impact: Severe for smaller/lesser-known companies; manageable for well-established brands
Incident : Ransomware MAR824090225
Financial Loss: £700 million (M&S market value wiped; ~£3.8M daily revenue loss from halted online sales)
Systems Affected: Online order processingContactless paymentsClick-and-collect servicesWarehouse logistics (Castle Donington)Gift card/return processingJob application portal
Downtime: {'online_orders': 'Ongoing since 2024-04-25 (as of 2024-05-02)', 'contactless_payments': 'Disrupted since 2024-04-21', 'warehouse_operations': 'Partial shutdown (200 agency workers sent home)'}
Operational Impact: Empty shelves in stores (e.g., Percy Pigs sweets shortage)Limited food availabilityPaused recruitment (200+ job listings removed)Supply chain disruptions
Revenue Loss: £3.8M/day (online sales halted; ~1/3 of clothing/home revenue)
Customer Complaints: Reported issues with payments, gift cards, and returns
Brand Reputation Impact: Significant (6.5% share price drop; publicized operational failures)
Payment Information Risk: Potential (contactless payment systems disrupted)
Incident : Unauthorized Access Attempt MAR843090225
Financial Loss: £650m wiped from M&S stock market value
Data Compromised: Unconfirmed for harrods; m&s and co-op: potential internal system data (no confirmation of customer data breach)
Systems Affected: Harrods: restricted internet access at sites, some systems shut downM&S: online orders halted (~1 week), automated stock systems, loyalty scheme, gift card payments, recruitment systems (job postings paused)Co-op: internal systems shut down, online conferencing security warnings
Downtime: ['Harrods: partial (internet access restricted, some systems down)', 'M&S: online shop down for ~1 week, ongoing disruptions', 'Co-op: partial (internal systems)']
Operational Impact: Harrods: minimal (stores and website operational)M&S: severe (shelf gaps, hiring freeze, 200+ job postings removed)Co-op: moderate (internal disruptions, staff warnings)
Revenue Loss: ['M&S: significant (£650m market cap loss)', None]
Brand Reputation Impact: Potential reputational damage for all three retailers, especially M&S due to prolonged disruptions
Payment Information Risk: ['M&S: gift card payment disruptions (no confirmation of theft)']
Incident : Cyber-Attack MAR844090225
Financial Loss: Significant (e.g., Marks & Spencer's 20% drop in clothing sales over 4 weeks)
Systems Affected: Website Ordering System (Marks & Spencer)Building Management SystemsCCTV NetworksIoT DevicesAccess Control SystemsHVAC/Lighting Systems
Downtime: 7 weeks (Marks & Spencer website)
Operational Impact: Halted online orders, loss of market share to competitors (Next, Zara, H&M), potential disruption to building operations (e.g., security, energy management)
Conversion Rate Impact: 20% decline in clothing sales (Marks & Spencer)
Brand Reputation Impact: Negative (loss of customer trust, market share decline)
Incident : Cyberattack MAR855090225
Financial Loss: Millions (e.g., M&S share price dropped 7%)
Systems Affected: Store SystemsOnline PlatformsIT Infrastructure
Downtime: Widespread outages (M&S, Co-Op); internet access restricted (Harrods)
Operational Impact: High (retail operations disrupted, revenue generation affected)
Revenue Loss: Significant (millions in lost sales for M&S)
Brand Reputation Impact: Potential long-term damage due to public disclosure and operational disruption
Incident : Ransomware (M&S) MAR5392253090725
Financial Loss: £300m market value loss (M&S)Up to £73m revenue loss per minute for payment outages (industry estimate)
Data Compromised: Customer names/contact details (adidas, co-op), Customer information (m&s, no payment details/passwords), None confirmed (harrods, h&m)
Systems Affected: Ecommerce, contactless payments (M&S)Internal IT systems, internet access (Harrods)Payments systems (H&M, in-store)IT systems (Co-op, leading to empty shelves)Third-party customer service (Adidas)
Downtime: ['>2 months (partial recovery for M&S)', 'Minimal (Harrods)', '2 hours (H&M, some locations)', 'Short-term (Co-op)', None]
Operational Impact: Suspended online orders, no contactless payments (M&S)Empty shelves (Co-op)In-store payment failures (H&M)Internet access paused in stores (Harrods)None (Adidas)
Revenue Loss: ['Significant (M&S, Co-op, H&M during outage)', None]
Customer Complaints: ['Likely (M&S, Co-op, H&M)', None]
Brand Reputation Impact: High (M&S, Co-op, H&M)Moderate (Harrods, Adidas)
Identity Theft Risk: ['Low (Adidas, Co-op: names/contact details only)', None]
Payment Information Risk: ['None (all incidents)']
Incident : Unauthorized Access Attempt MAR1662016090825
Systems Affected: Back-office systems (Co-op)Call centers (Co-op)Servers (M&S, encrypted)Online ordering systems (M&S)App-based ordering (M&S)
Downtime: ['Partial (Co-op back-office/call centers)', '6+ days (M&S clothing/home orders)']
Operational Impact: Disruption to call centers (Co-op)Paused clothing/home orders (M&S)Limited food product availability (M&S)
Brand Reputation Impact: Potential reputational damage (both companies)Disruption during peak summer demand (M&S)
Incident : ransomware MAR0762307092425
Systems Affected: internal systemscritical employee files
Operational Impact: employee lockout from critical filesdisruption of internal operations
Brand Reputation Impact: potential erosion of trust due to public disclosure of breach
Incident : ransomware MAR2902029102225
Financial Loss: £300m in gross lost profits (estimated)
Systems Affected: online store (closed for ~7 weeks)online clothing distribution center (Castle Donington, Leicestershire)
Downtime: ~7 weeks (online store closure)
Operational Impact: trauma described as 'out of body experience'rebuild mode ongoingdistribution center still offline as of disclosurereliance on pen-and-paper processes
Revenue Loss: £300m in gross lost profits (estimated)
Brand Reputation Impact: significant (described as 'traumatic')public disclosure of vulnerabilities
Incident : Data Breach MAR1993619102425
Downtime: True
Revenue Loss: True
Identity Theft Risk: True
Payment Information Risk: True
Incident : Cyberattack MAR3792037102625
Financial Loss: £300 million (estimated lost operating profit)
Systems Affected: Online Shopping PlatformClick-and-Collect OperationsSupply Chain SystemsInventory ManagementStore Stocking Systems
Downtime: ['Extended suspension of online orders (weeks)', 'Partial halt of click-and-collect services']
Operational Impact: Empty shelves in physical storesSupply chain disruptionsInventory mismanagementLoss of customer trust
Conversion Rate Impact: Significant (customers unable to place orders)
Revenue Loss: £1 billion+ (market capitalization wiped out)
Customer Complaints: Widespread (due to unfulfilled orders and stock shortages)
Brand Reputation Impact: Severe (damaged reliability perception, competitive disadvantage)
Incident : Cyber Attack MAR5032050110325
Financial Loss: $25M (Hong Kong Deepfake Fraud); Undisclosed for Marks and Spencer
Operational Impact: Disruption of Critical ApplicationsPotential Loss of Customer TrustRegulatory Scrutiny
Brand Reputation Impact: High (Marks and Spencer CEO initiated timely communications to mitigate damage)Long-term Trust Erosion Risk
Incident : ransomware MAR1193411110425
Systems Affected: local storagenetwork shares via SMB
Operational Impact: encryption of filespotential data leaks (threatened for September 2 and 22)disruption of rival ransomware operations (e.g., BlackLock, Ransomhub)
Brand Reputation Impact: potential reputational damage to affected entities (e.g., Marks & Spencer)undermining trust in rival ransomware groups
Incident : Cyber Attack MAR0102201110625
Systems Affected: Inventory ManagementE-commerce PlatformTransactional WebsiteSupply Chain
Downtime: ['Prolonged (summer 2025)', 'Transactional website inoperable for an unspecified period']
Operational Impact: Stock availability issuesInability to process online ordersCustomer defection to competitors (e.g., Next)Slower recovery in clothing sales vs. food
Conversion Rate Impact: Decline (customers unable to complete purchases)
Revenue Loss: Indirect (profit decline despite 22.1% sales growth)
Customer Complaints: Likely (implied by 'headache' for online shoppers)
Brand Reputation Impact: Short-term erosionRisk of long-term customer loss (especially in clothing)Need for 'clever marketing' to rebuild trust
Incident : Data Breach MAR2433524112725
Financial Loss: £11.8m (online shopping fraud, Nov 2024–Jan 2025)
Downtime: True
Operational Impact: Empty shelves (M&S, Co-Op Group); potential catastrophic profit loss during peak sales
Brand Reputation Impact: High (trust erosion from fraud/scams)
Identity Theft Risk: High (PII exposure via fake sites/phishing)
Payment Information Risk: High (fraud targeting payment data)
Incident : data breach MAR28102028112725
Data Compromised: Basic contact details, Dates of birth, Online order histories, Masked payment information, Customer reference numbers (m&s credit card/sparks pay holders)
Systems Affected: online purchase systemsstore inventory systems
Operational Impact: disrupted online purchases and store inventories
Brand Reputation Impact: potential reputational damage due to customer data exposure
Identity Theft Risk: high (due to personal details exposed)
Payment Information Risk: low (payment data masked and unusable)
Incident : Cyberattack MAR19103519112725
Data Compromised: Status: P, o, t, e, n, t, i, a, l, l, y, , c, o, m, p, r, o, m, i, s, e, d, , (, c, l, a, i, m, e, d, , b, y, , D, r, a, g, o, n, F, o, r, c, e, ,, , n, o, t, , y, e, t, , l, e, a, k, e, d, ),
Systems Affected: App (unavailable)Online shopping platform (paused)Supply chain systemsStore stocking processesManual logistics operations
Downtime: {'app_online_shopping': 'April–July 2024 (ongoing as of disclosure)', 'supply_chain': 'April–July 2024 (improving but not fully resolved)'}
Operational Impact: Food Sales: Reduced availability (improving), Fashion Home Beauty: Online sales halted; stores resilient, Waste Logistics: Increased costs due to manual processes, Stock Management: Disrupted (Q1–Q2 2024),
Brand Reputation Impact: Share Price: {'immediate_after_disclosure': '+1.9% (Wednesday)', 'five_day_change': '+5%', 'since_attack_confirmation': '-8.8% from pre-attack high'},
Identity Theft Risk: Potential (if customer data was exfiltrated)
What is the average financial loss per incident ?
Average Financial Loss: The average financial loss per incident is $2.24 billion.
What types of data are most commonly compromised in incidents ?
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Personally Identifiable Information (PII), Personal Data, Personal Customer Data, , Customer data, Home Addresses, Phone Numbers, Dates Of Birth, , Personal Information, Order Histories, , Sensitive Data, Active Directory Database, , Personally Identifiable Information (Pii), , Unconfirmed; Potential Internal System Data (M&S/Co-Op), Harrods: No Evidence Of Data Access, , Customer Names/Contact Details (Adidas, Co-Op), Customer Information (M&S, No Specifics), , Customer Records (Co-Op: 6.5M), Potential Payment Information (M&S), Personally Identifiable Information (Pii), , Customer Databases, Personally Identifiable Information (Pii), Payment Information (Fraud Targets), , Personal Identifiable Information (Pii), Order History, Masked Payment Data, Customer Reference Numbers, , Potentially customer data (claimed by DragonForce and unconfirmed).
Which entities were affected by each incident ?
Incident : Ransomware MAR1041050625
Entity Name: Marks & Spencer
Entity Type: Retailer
Industry: Retail
Incident : Ransomware Attack MAR347051325
Entity Name: Marks and Spencer
Entity Type: Retail
Industry: Retail
Incident : Data Breach MAR528051425
Entity Name: Marks & Spencer
Entity Type: Retail Chain
Industry: Retail
Location: Britain
Incident : Ransomware MAR356052125
Entity Name: Marks & Spencer
Entity Type: Retailer
Industry: Retail
Location: United Kingdom
Size: 1,400 stores
Incident : Cyberattack MAR900062025
Entity Name: Marks and Spencer
Entity Type: Retailer
Industry: Retail
Incident : Ransomware MAR601070925
Entity Name: Marks & Spencer (M&S)
Entity Type: Retailer
Industry: Retail
Location: UK
Size: Large
Incident : Ransomware MAR847071225
Entity Name: Marks and Spencer
Entity Type: Retailer
Industry: Retail
Location: UK
Incident : Ransomware MAR419071725
Entity Name: Marks & Spencer (M&S)
Entity Type: Retail
Industry: Retail
Location: UK
Incident : Ransomware MAR419071725
Entity Name: The Co-op
Entity Type: Retail
Industry: Retail
Location: UK
Incident : Ransomware MAR419071725
Entity Name: Harrods
Entity Type: Retail
Industry: Retail
Location: UK
Incident : Ransomware MAR956072325
Entity Name: NHS
Entity Type: Publicly funded healthcare service
Industry: Healthcare
Location: UK
Incident : Ransomware MAR956072325
Entity Name: British Library
Entity Type: National library
Industry: Education
Location: UK
Incident : Ransomware MAR956072325
Entity Name: Marks & Spencer
Entity Type: Retailer
Industry: Retail
Location: UK
Size: 1,400 stores
Incident : Ransomware MAR956072325
Entity Name: Co-op
Entity Type: Retailer
Industry: Retail
Location: UK
Customers Affected: Data from many current and former members
Incident : Ransomware MAR956072325
Entity Name: Harrods
Entity Type: Retailer
Industry: Retail
Location: UK
Incident : Ransomware, Data Theft MAR903072925
Entity Name: M&S
Entity Type: Retail
Industry: Retail
Location: UK
Incident : Ransomware, Data Theft MAR903072925
Entity Name: Harrods
Entity Type: Retail
Industry: Retail
Location: UK
Incident : Ransomware, Data Theft MAR903072925
Entity Name: Co-op
Entity Type: Retail
Industry: Retail
Location: UK
Incident : Data Breach MAR451082725
Entity Name: Marks and Spencer (M&S)
Entity Type: Retailer
Industry: Retail (Clothing, Food, Home Goods)
Location: United Kingdom
Size: Large (FTSE 100 constituent)
Customers Affected: Unknown (all online customers notified)
Incident : Data Breach MAR451082725
Entity Name: Co-op
Entity Type: Retailer
Industry: Retail (Grocery, Funeralcare, Legal Services)
Location: United Kingdom
Incident : Data Breach MAR451082725
Entity Name: Harrods
Entity Type: Retailer
Industry: Luxury Retail
Location: United Kingdom
Incident : Cyber Attack MAR628082925
Entity Name: Marks & Spencer (M&S)
Entity Type: Retailer
Industry: Retail
Location: UK
Size: Large
Incident : Cyber Attack MAR628082925
Entity Name: Co-op
Entity Type: Retailer
Industry: Retail/Grocery
Location: UK
Size: Large
Incident : Cyber Attack MAR628082925
Entity Name: Cartier
Entity Type: Luxury Brand
Industry: Luxury Goods
Location: UK (global operations)
Size: Large
Incident : Cyber Attack MAR628082925
Entity Name: Harrods
Entity Type: Luxury Department Store
Industry: Retail
Location: UK
Size: Large
Incident : Cyber Attack MAR628082925
Entity Name: LVMH (Moët Hennessy Louis Vuitton)
Entity Type: Luxury Conglomerate
Industry: Luxury Goods
Location: UK (global operations)
Size: Large
Incident : Cyber Attack MAR628082925
Entity Name: Over 50% of UK businesses (collective)
Entity Type: SMEs, Large Enterprises
Industry: Multiple
Location: UK
Size: Varies
Incident : Ransomware MAR824090225
Entity Name: Marks & Spencer (M&S)
Entity Type: Retailer
Industry: Retail (Clothing, Food, Home Goods)
Location: United Kingdom
Size: Large (FTSE 250 company)
Incident : Ransomware MAR824090225
Entity Name: Harrods
Entity Type: Department Store
Industry: Luxury Retail
Location: London, United Kingdom
Size: Large (Privately held)
Incident : Unauthorized Access Attempt MAR843090225
Entity Name: Harrods
Entity Type: Luxury Department Store
Industry: Retail
Location: UK (Knightsbridge flagship, H beauty, airport outlets)
Customers Affected: None suspected (per Harrods statement)
Incident : Unauthorized Access Attempt MAR843090225
Entity Name: Marks & Spencer (M&S)
Entity Type: Retailer
Industry: Retail
Location: UK
Size: ~65,000 employees
Customers Affected: Potential disruption to loyalty scheme and gift card users; no confirmed data breach
Incident : Unauthorized Access Attempt MAR843090225
Entity Name: Co-op
Entity Type: Retailer
Industry: Retail
Location: UK
Customers Affected: None reported
Incident : Cyber-Attack MAR844090225
Entity Name: Marks & Spencer
Entity Type: Retailer
Industry: Retail (Clothing, Food, Home Goods)
Location: United Kingdom
Size: Large (Multinational)
Incident : Cyber-Attack MAR844090225
Entity Name: Unspecified UK Businesses (27% of surveyed)
Entity Type: Commercial Buildings, Facilities Management Firms, Consultancies
Industry: Multiple (Real Estate, Retail, Critical Infrastructure, etc.)
Location: United Kingdom
Incident : Cyberattack MAR855090225
Entity Name: Harrods
Entity Type: Luxury Department Store
Industry: Retail
Location: United Kingdom
Incident : Cyberattack MAR855090225
Entity Name: Marks & Spencer (M&S)
Entity Type: Retailer
Industry: Retail
Location: United Kingdom
Incident : Cyberattack MAR855090225
Entity Name: Co-Op
Entity Type: Supermarket Chain
Industry: Retail
Location: United Kingdom
Incident : Ransomware (M&S) MAR5392253090725
Entity Name: Marks and Spencer (M&S)
Entity Type: Retailer
Industry: Retail (Food, Clothing, Home)
Location: UK
Size: Large (300+ stores, ~70,000 employees)
Customers Affected: All online customers, in-store contactless payment users
Incident : Ransomware (M&S) MAR5392253090725
Entity Name: The Co-operative Group
Entity Type: Member-owned Retailer
Industry: Retail (Supermarkets, Funeralcare, Legal Services)
Location: UK
Size: Large (2,000+ stores, ~56,000 employees)
Customers Affected: Members (names/contact details), in-store shoppers (empty shelves)
Incident : Ransomware (M&S) MAR5392253090725
Entity Name: Harrods
Entity Type: Luxury Department Store
Industry: Retail (Luxury Goods)
Location: London, UK
Size: Large (1 store, ~4,000 employees)
Customers Affected: Minimal (no data breach)
Incident : Ransomware (M&S) MAR5392253090725
Entity Name: Adidas
Entity Type: Multinational Corporation
Industry: Sporting Goods/Retail
Location: Global (UK operations affected)
Size: Large (~69,000 employees worldwide)
Customers Affected: Help desk contacts (names/contact details)
Incident : Ransomware (M&S) MAR5392253090725
Entity Name: H&M
Entity Type: Multinational Retailer
Industry: Fashion/Retail
Location: Global (UK stores affected)
Size: Large (~155,000 employees worldwide)
Customers Affected: In-store shoppers (payment disruptions)
Incident : Unauthorized Access Attempt MAR1662016090825
Entity Name: Co-op Group
Entity Type: Retailer (Member-Owned Cooperative)
Industry: Retail (Food), Funeral Care, Legal Services, Insurance
Location: United Kingdom
Size: 2,300+ food stores nationwide
Incident : Unauthorized Access Attempt MAR1662016090825
Entity Name: Marks & Spencer (M&S)
Entity Type: Public Retailer
Industry: Retail (Clothing, Home, Food)
Location: United Kingdom
Incident : ransomware MAR0762307092425
Entity Name: Marks & Spencer (M&S)
Entity Type: retailer
Industry: retail
Location: United Kingdom
Size: large enterprise
Incident : ransomware MAR2902029102225
Entity Name: Marks & Spencer (M&S)
Entity Type: retailer
Industry: retail (clothing, food, home goods)
Location: United Kingdom
Size: large (FTSE 100 company)
Incident : Data Breach MAR1993619102425
Entity Name: Marks & Spencer (M&S)
Entity Type: Retailer
Industry: Retail
Location: United Kingdom
Size: Large (Multinational)
Incident : Data Breach MAR1993619102425
Entity Name: Co-op
Entity Type: Retailer
Industry: Retail (Grocery/Convenience)
Location: United Kingdom
Size: Large
Customers Affected: 6.5 million
Incident : Data Breach MAR1993619102425
Entity Name: Louis Vuitton
Entity Type: Luxury Retailer
Industry: Fashion/Retail
Location: Global (HQ in France)
Size: Large (Multinational)
Incident : Cyberattack MAR3792037102625
Entity Name: Marks & Spencer (M&S)
Entity Type: Retailer
Industry: Retail (Clothing, Food, Home Goods)
Location: United Kingdom
Size: Large (Multinational, FTSE 100)
Customers Affected: Millions (online shoppers, in-store customers)
Incident : Cyberattack MAR3792037102625
Entity Name: Tata Consultancy Services (TCS)
Entity Type: IT Services Provider
Industry: Information Technology
Location: India (HQ: Mumbai)
Size: Large (Multinational, 600,000+ employees)
Incident : Cyber Attack MAR5032050110325
Entity Name: Marks and Spencer
Entity Type: Retail
Industry: Retail/Consumer Goods
Location: United Kingdom
Size: Large Enterprise
Incident : Cyber Attack MAR5032050110325
Entity Name: Two US Casinos (Unnamed)
Entity Type: Hospitality/Gaming
Industry: Entertainment
Location: United States
Incident : Cyber Attack MAR5032050110325
Entity Name: Transport for London
Entity Type: Government/Transportation
Industry: Public Sector
Location: United Kingdom
Incident : Cyber Attack MAR5032050110325
Entity Name: Hong Kong Financial Firm (Unnamed)
Entity Type: Private
Industry: Finance
Location: Hong Kong
Incident : ransomware MAR1193411110425
Entity Name: Marks & Spencer
Entity Type: retailer
Industry: retail
Location: United Kingdom
Incident : ransomware MAR1193411110425
Entity Name: BlackLock (rival ransomware group)
Entity Type: cybercriminal group
Incident : ransomware MAR1193411110425
Entity Name: Ransomhub (rival ransomware group)
Entity Type: cybercriminal group
Incident : Cyber Attack MAR0102201110625
Entity Name: Marks & Spencer (M&S)
Entity Type: Publicly Traded Retailer
Industry: Retail (Clothing, Food, Home Goods)
Location: United Kingdom
Size: Large (FTSE 100)
Customers Affected: Widespread (no specific number provided)
Incident : Data Breach MAR2433524112725
Entity Name: Marks & Spencer (M&S)
Entity Type: Retailer
Industry: Retail
Location: UK
Size: Large
Incident : Data Breach MAR2433524112725
Entity Name: Co-Op Group
Entity Type: Retailer
Industry: Retail
Location: UK
Size: Large
Incident : Data Breach MAR2433524112725
Entity Name: Unspecified UK Retailers (1,381 incidents)
Entity Type: Retail/Manufacturing
Industry: Retail/Manufacturing
Location: UK
Incident : Data Breach MAR2433524112725
Entity Name: UK Consumers (Festive Season Fraud Victims)
Entity Type: Individuals
Location: UK
Incident : data breach MAR28102028112725
Entity Name: Marks and Spencer Group
Entity Type: retailer
Industry: retail
Location: United Kingdom
Size: large
Incident : data breach MAR28102028112725
Entity Name: Harrods
Entity Type: retailer
Industry: luxury retail
Location: United Kingdom
Size: large
Incident : data breach MAR28102028112725
Entity Name: Co-op
Entity Type: retailer
Industry: supermarket
Location: United Kingdom
Size: large
Incident : Cyberattack MAR19103519112725
Entity Name: Marks & Spencer (M&S)
Entity Type: Publicly Traded Company
Industry: Retail (Food, Fashion, Home, Beauty)
Location: United Kingdom
Size: Large (FTSE 100 constituent)
Customers Affected: Potentially all online/app users (number not specified)
Response to the Incidents
What measures were taken in response to each incident ?
Incident : Ransomware MAR1041050625
Remediation Measures: Restore encrypted virtual machinesSanitize systems
Network Segmentation: Need for stronger network segmentation
Enhanced Monitoring: Faster ransomware detection capabilities
Incident : Ransomware Attack MAR347051325
Containment Measures: Disabled online shopping ordersDisabled click and collectDisabled contactless payments in some stores
Communication Strategy: Letter to customers
Incident : Data Breach MAR528051425
Law Enforcement Notified: Yes
Communication Strategy: Affected customers were notified
Incident : Ransomware MAR558070925
Third Party Assistance: Tata Consultancy Services.
Containment Measures: Shut down systems to prevent further spread
Recovery Measures: Recovery efforts ongoingFull recovery expected by October or November 2025
Communication Strategy: Calling for greater transparency and cyberattack reporting
Incident : Ransomware MAR601070925
Third Party Assistance: Professional intermediaries
Containment Measures: Shutting down systems
Remediation Measures: Rebuilding systems
Recovery Measures: Bringing systems back up securely
Communication Strategy: Media channels, including BBC
Network Segmentation: Not heavily segmented
Incident : Ransomware MAR419071725
Law Enforcement Notified: Yes
Incident : Ransomware MAR956072325
Incident : Ransomware, Data Theft MAR903072925
Enhanced Monitoring: Strong identity verificationVMware hardeningBackup integrityContinuous monitoring
Incident : Data Breach MAR451082725
Incident Response Plan Activated: True
Third Party Assistance: Organizations Involved: ['UK National Cyber Security Centre (NCSC)'].
Remediation Measures: Password resets for affected customers
Communication Strategy: Customer Notification: Letters sent to affected customers, Public Statement: Issued to media and on company channels, Advisory: No action required by customers except password reset on next login.
Incident : Ransomware MAR824090225
Incident Response Plan Activated: Yes (Systems taken offline as precaution)
Third Party Assistance: Yes (Cybersecurity experts engaged by Harrods)
Law Enforcement Notified: Yes (Metropolitan Police and NCSC investigating)
Containment Measures: Online orders suspendedJob listings removedAffected systems isolated
Communication Strategy: Initial public disclosure (2024-04-21)Limited updates (last statement on 2024-04-25)Harrods assured customers of normal operations
Incident : Unauthorized Access Attempt MAR843090225
Incident Response Plan Activated: ['Yes (all three retailers)']
Third Party Assistance: Ncsc (Assisting M&S And Co-Op), National Crime Agency (Nca) And Metropolitan Police Cybercrime Unit (M&S Investigation).
Law Enforcement Notified: Yes (Metropolitan Police and NCA for M&S),
Containment Measures: Harrods: restricted internet access, shut down some systemsM&S: halted online orders, paused hiring/recruitment systemsCo-op: shut down internal systems, staff warnings for online conferencing
Recovery Measures: M&S: working to restore online shop and recruitment systems
Communication Strategy: Harrods: public statement (no customer action required)M&S: updates on job site ('working hard to be back online')Co-op: internal staff warnings
Incident : Cyber-Attack MAR844090225
Remediation Measures: Urgent calls for security countermeasures in smart buildingsReplacement of outdated systems (e.g., Windows 7)
Communication Strategy: Public disclosure via Rics reportMedia coverage (The Guardian)
Incident : Cyberattack MAR855090225
Containment Measures: Restricted internet access (Harrods)IT systems taken down (Co-Op)
Enhanced Monitoring: Security teams advised to deploy endpoint protection software
Incident : Ransomware (M&S) MAR5392253090725
Incident Response Plan Activated: ['Yes (M&S, Harrods, Co-op)', None]
Third Party Assistance: Likely (M&S, Co-Op For Forensic Investigation).
Containment Measures: Restricted internal IT systems, paused internet access (Harrods)Shut down parts of IT systems (Co-op)Suspended online orders (M&S)
Remediation Measures: Partial restoration of online services (M&S)
Recovery Measures: Ongoing (M&S)Quick recovery (H&M, Harrods)
Communication Strategy: Public disclosures (all)Customer apologies (H&M, M&S)
Incident : Unauthorized Access Attempt MAR1662016090825
Incident Response Plan Activated: ['Yes (Co-op: proactive steps)', 'Yes (M&S: systems taken offline)']
Third Party Assistance: National Cyber Security Centre (Ncsc), National Crime Agency (Nca), Metropolitan Police Cyber Crime Unit.
Law Enforcement Notified: Yes (M&S: Metropolitan Police investigating), Likely (Co-op: not explicitly stated),
Containment Measures: Shut down back-office/call center systems (Co-op)Offline systems (M&S)
Recovery Measures: Working to reduce disruption (Co-op)
Communication Strategy: Public statements (both companies)
Incident : ransomware MAR2902029102225
Incident Response Plan Activated: True
Third Party Assistance: National Cyber Security Centre (Ncsc), Fbi, National Crime Agency, Metropolitan Police, Ransomware Specialists (Unspecified).
Containment Measures: isolation of affected systemsshutdown of online storereliance on pen-and-paper processes
Remediation Measures: ongoing rebuild of systemscollaboration with law enforcement
Recovery Measures: expected full online operations by end of month (post-attack)insurance claim of >£100m
Communication Strategy: transparency with MPs during subcommittee hearingno public disclosure of ransom interactions
Enhanced Monitoring: invested hundreds of millions in cybersecurity pre-attackexpanded prevention team to 80 staff
Incident : Data Breach MAR1993619102425
Containment Measures: Network Segmentation (Recommended)Isolation of Affected Systems (Recommended)
Remediation Measures: Centralized Log ManagementReal-Time Threat DetectionPatch/Vulnerability ManagementIdentity and Access Control Reforms (MFA, Least Privilege)
Recovery Measures: Immutable Backups (Recommended)System Restoration Protocols
Communication Strategy: Transparency in Public Disclosures (Recommended)Stakeholder/Regulator Notifications
Network Segmentation: True
Incident : Cyberattack MAR3792037102625
Incident Response Plan Activated: Yes (though details undisclosed)
Containment Measures: Suspension of online ordersPartial halt of click-and-collect servicesIsolation of compromised systems (presumed)
Remediation Measures: Contract termination with TCS for help-desk servicesReview of third-party access controlsEnhanced authentication for vendor logins (presumed)
Recovery Measures: Restoration of online shopping platformRebuilding supply chain operationsCustomer communication campaigns
Communication Strategy: Public disclosure of incidentStatements to MPs (UK Parliament)Investor updatesMedia responses
Enhanced Monitoring: Likely (though not explicitly stated)
Incident : Cyber Attack MAR5032050110325
Incident Response Plan Activated: Likely (Marks and Spencer CEO initiated communications; incident response retainers mentioned as best practice)
Third Party Assistance: Cloud Backup Providers (E.G., Amazon, Google, Microsoft), Specialist Third-Party Backup Services, Incident Response Retainers.
Remediation Measures: CEO-Led Transparent CommunicationCloud Backups for Data RecoveryEmployee Training on Deepfake/Phishing
Recovery Measures: Prioritization of Critical Applications (e.g., Payroll, Supplier Payments)Third-Party Support for Restoration
Communication Strategy: Timely Digital Communications by CEO (Marks and Spencer)Transparency with Regulators/Investors
Enhanced Monitoring: Early Detection Technologies for Threat Identification
Incident : ransomware MAR1193411110425
Network Segmentation: ['recommended as a defense measure']
Enhanced Monitoring: recommended for unusual access to shared resources
Incident : Cyber Attack MAR0102201110625
Incident Response Plan Activated: Yes (implied by recovery efforts)
Containment Measures: Restoration of shops and websites to normal operations
Remediation Measures: Accelerated investment in cybersecurity technologySupply chain improvementsStore updates
Recovery Measures: Marketing campaigns for autumn/winter rangesProduct innovation (especially in food)Ocado joint venture optimization
Communication Strategy: Public disclosure via half-year results (Nov 5, 2025)Media statements on recovery plans
Enhanced Monitoring: Planned (part of cybersecurity investment)
Incident : Data Breach MAR2433524112725
Communication Strategy: Public advisories (e.g., NCSC warnings on fraud trends)
Enhanced Monitoring: Recommended (continuous assurance for drift detection)
Incident : data breach MAR28102028112725
Incident Response Plan Activated: True
Third Party Assistance: U.K. National Cyber Security Centre (Ncsc).
Remediation Measures: password reset prompts for customerscustomer advisories on online safety
Communication Strategy: trading update from CEO Stuart Machincustomer note from Operations Director Jayne WallFAQ page for affected customers
Incident : Cyberattack MAR19103519112725
Incident Response Plan Activated: True
Law Enforcement Notified: status: UK police investigating (as part of broader retail cyberattacks), details: None,
Containment Measures: Pausing online shoppingManual logistics processes
Recovery Measures: Planned: ['Restart and ramp up online operations (June–July 2024)', 'Upgrade infrastructure and network connectivity', 'Enhance store/colleague technology', 'Improve supply chain systems'], Status: Ongoing (accelerated investment phase),
Communication Strategy: Public Statements: ['London Stock Exchange filing (Wednesday)', 'Customer advisories (data compromise warning)'], Transparency: Partial (no confirmation/denial of ransom payment).
What is the company's incident response plan?
Incident Response Plan: The company's incident response plan is described as Yes (Systems taken offline as precaution), Yes (all three retailers), , Yes (M&S, Harrods, Co-op), , Yes (Co-op: proactive steps), Yes (M&S: systems taken offline), , , Yes (though details undisclosed), Likely (Marks and Spencer CEO initiated communications; incident response retainers mentioned as best practice), Yes (implied by recovery efforts), , .
How does the company involve third-party assistance in incident response ?
Third-Party Assistance: The company involves third-party assistance in incident response through Tata Consultancy Services, , Professional intermediaries, organizations involved: uk national cyber security centre (ncsc), , Yes (Cybersecurity experts engaged by Harrods), NCSC (assisting M&S and Co-op), National Crime Agency (NCA) and Metropolitan Police Cybercrime Unit (M&S investigation), , Likely (M&S, Co-op for forensic investigation), , National Cyber Security Centre (NCSC), National Crime Agency (NCA), Metropolitan Police Cyber Crime Unit, , National Cyber Security Centre (NCSC), FBI, National Crime Agency, Metropolitan Police, ransomware specialists (unspecified), , Cloud Backup Providers (e.g., Amazon, Google, Microsoft), Specialist Third-Party Backup Services, Incident Response Retainers, , U.K. National Cyber Security Centre (NCSC), .
Data Breach Information
What type of data was compromised in each breach ?
Incident : Ransomware MAR1041050625
Data Exfiltration: No customer data exfiltrated
Incident : Ransomware Attack MAR347051325
Type of Data Compromised: Personally Identifiable Information (PII)
Incident : Data Breach MAR528051425
Type of Data Compromised: Personal Data
Incident : Cyberattack MAR733051525
Type of Data Compromised: Personal customer data
Incident : Ransomware MAR356052125
Type of Data Compromised: Customer data
Data Exfiltration: Yes
Data Encryption: Yes
Incident : Cyberattack MAR900062025
Type of Data Compromised: Home addresses, Phone numbers, Dates of birth
Sensitivity of Data: Medium
Data Exfiltration: Yes
Personally Identifiable Information: Yes
Incident : Ransomware MAR558070925
Type of Data Compromised: Personal information, Order histories
Sensitivity of Data: Medium to High
Data Encryption: True
Incident : Ransomware MAR419071725
Data Exfiltration: Yes
Incident : Ransomware, Data Theft MAR903072925
Type of Data Compromised: Sensitive data, Active directory database
Incident : Data Breach MAR451082725
Type of Data Compromised: Personally identifiable information (pii)
Sensitivity of Data: Moderate (no financial or password data, but includes contact details)
Data Exfiltration: Evidence Of Exfiltration: None confirmed (M&S stated no evidence data was shared), Status: Unconfirmed,
Personally Identifiable Information: NamesHome addressesEmail addressesPhone numbers
Incident : Ransomware MAR824090225
Data Encryption: Yes (DragonForce ransomware encrypted files)
Incident : Unauthorized Access Attempt MAR843090225
Type of Data Compromised: Unconfirmed; potential internal system data (m&s/co-op), Harrods: no evidence of data access
Personally Identifiable Information: M&S: no confirmation; WH Smith precedent (employee data breached in 2023) mentioned as context
Incident : Ransomware (M&S) MAR5392253090725
Type of Data Compromised: Customer names/contact details (adidas, co-op), Customer information (m&s, no specifics)
Sensitivity of Data: Low (Adidas, Co-op: PII but no financial data)
Data Exfiltration: Yes (Adidas, Co-op, M&S)No evidence (Harrods)
Personally Identifiable Information: Yes (names, contact details for Adidas/Co-op)Unspecified (M&S)
Incident : Unauthorized Access Attempt MAR1662016090825
Data Encryption: ['Yes (M&S servers encrypted)']
Incident : ransomware MAR0762307092425
Data Encryption: ['critical employee files encrypted']
Incident : ransomware MAR2902029102225
Data Encryption: ['ransomware encryption of systems']
Incident : Data Breach MAR1993619102425
Type of Data Compromised: Customer records (co-op: 6.5m), Potential payment information (m&s), Personally identifiable information (pii)
Number of Records Exposed: 6.5 million (Co-op)
Sensitivity of Data: High (PII, Payment Data)
Incident : ransomware MAR1193411110425
Data Exfiltration: threatened (e.g., leaks scheduled for September 2 and 22)
Data Encryption: ['ChaCha20 + RSA per-file encryption', '10-byte metadata block (encodes mode, percentage, size)', 'supports full (0x24), partial (0x25), and header-only (0x26) modes']
Incident : Data Breach MAR2433524112725
Type of Data Compromised: Customer databases, Personally identifiable information (pii), Payment information (fraud targets)
Sensitivity of Data: High
Incident : data breach MAR28102028112725
Type of Data Compromised: Personal identifiable information (pii), Order history, Masked payment data, Customer reference numbers
Sensitivity of Data: moderate to high (PII, order history, but no usable payment data)
Incident : Cyberattack MAR19103519112725
Type of Data Compromised: Potentially customer data (claimed by DragonForce, unconfirmed)
Data Exfiltration: Status: Claimed by threat actor (not yet leaked on darknet),
Personally Identifiable Information: Potential (unconfirmed)
What measures does the company take to prevent data exfiltration ?
Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Restore encrypted virtual machines, Sanitize systems, , Rebuilding systems, Password resets for affected customers, , Urgent calls for security countermeasures in smart buildings, Replacement of outdated systems (e.g., Windows 7), , Partial restoration of online services (M&S), , ongoing rebuild of systems, collaboration with law enforcement, , Centralized Log Management, Real-Time Threat Detection, Patch/Vulnerability Management, Identity and Access Control Reforms (MFA, Least Privilege), , Contract termination with TCS for help-desk services, Review of third-party access controls, Enhanced authentication for vendor logins (presumed), , CEO-Led Transparent Communication, Cloud Backups for Data Recovery, Employee Training on Deepfake/Phishing, , Accelerated investment in cybersecurity technology, Supply chain improvements, Store updates, , password reset prompts for customers, customer advisories on online safety, .
How does the company handle incidents involving personally identifiable information (PII) ?
Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by disabled online shopping orders, disabled click and collect, disabled contactless payments in some stores, , shut down systems to prevent further spread, , shutting down systems, online orders suspended, job listings removed, affected systems isolated, , harrods: restricted internet access, shut down some systems, m&s: halted online orders, paused hiring/recruitment systems, co-op: shut down internal systems, staff warnings for online conferencing, , restricted internet access (harrods), it systems taken down (co-op), , restricted internal it systems, paused internet access (harrods), shut down parts of it systems (co-op), suspended online orders (m&s), , shut down back-office/call center systems (co-op), offline systems (m&s), , isolation of affected systems, shutdown of online store, reliance on pen-and-paper processes, , network segmentation (recommended), isolation of affected systems (recommended), , suspension of online orders, partial halt of click-and-collect services, isolation of compromised systems (presumed), , restoration of shops and websites to normal operations, , pausing online shopping, manual logistics processes and .
Ransomware Information
Was ransomware involved in any of the incidents ?
Incident : Ransomware MAR1041050625
Data Encryption: Encryptor deployed on VMware ESXi hosts
Data Exfiltration: No customer data exfiltrated
Incident : Ransomware MAR356052125
Ransomware Strain: DragonForce
Data Encryption: Yes
Data Exfiltration: Yes
Incident : Ransomware MAR558070925
Ransomware Strain: DragonForce
Data Encryption: True
Data Exfiltration: True
Incident : Ransomware MAR601070925
Ransomware Strain: DragonForce
Incident : Ransomware MAR847071225
Ransomware Strain: DragonForce
Data Encryption: Virtual machines encrypted
Incident : Ransomware MAR419071725
Data Exfiltration: Yes
Incident : Ransomware MAR956072325
Ransomware Strain: DragonForce
Data Encryption: Virtual machines on VMware ESXi hosts
Incident : Data Breach MAR451082725
Ransomware Strain: claimed: DragonForce, confirmed: False,
Incident : Cyberattack MAR855090225
Ransomware Strain: ScatteredSpider (alleged for M&S)
Incident : Ransomware (M&S) MAR5392253090725
Ransom Demanded: ['Likely (M&S, linked to DragonForce)', None]
Ransomware Strain: DragonForce (suspected for M&S)
Data Encryption: ['Likely (M&S)', None]
Data Exfiltration: ['Yes (M&S customer data)', None]
Incident : Unauthorized Access Attempt MAR1662016090825
Ransom Demanded: ['Yes (M&S: alleged, amount undisclosed)', None]
Ransomware Strain: DragonForce (alleged for M&S)
Data Encryption: ['Yes (M&S)']
Incident : ransomware MAR0762307092425
Data Encryption: True
Incident : ransomware MAR2902029102225
Ransom Demanded: ["unspecified (referred to as 'very large sum' by MP David Davis for an unnamed company)", 'M&S declined to comment']
Ransom Paid: M&S: no confirmation (stated 'not discussing details')unnamed UK company: paid (per MP David Davis)
Ransomware Strain: DragonForce
Data Encryption: True
Incident : ransomware MAR1193411110425
Ransomware Strain: DragonForce (derived from Conti’s leaked source code)Devman (affiliate variant)Mamona (earlier variant used by Devman)
Data Encryption: ['ChaCha20 + RSA', 'unique key per file', 'metadata block with encryption details']
Data Exfiltration: ['threatened (e.g., leaks scheduled for September 2 and 22)']
Incident : data breach MAR28102028112725
Data Exfiltration: True
Incident : Cyberattack MAR19103519112725
Ransomware Strain: DragonForce
Data Encryption: {'status': 'Likely (given ransomware attribution)', 'details': None}
Data Exfiltration: {'status': 'Claimed (not yet published)', 'details': None}
How does the company recover data encrypted by ransomware ?
Data Recovery from Ransomware: The company recovers data encrypted by ransomware through Recovery efforts ongoing, Full recovery expected by October or November 2025, , Bringing systems back up securely, M&S: working to restore online shop and recruitment systems, , Ongoing (M&S), Quick recovery (H&M, Harrods), , Working to reduce disruption (Co-op), , expected full online operations by end of month (post-attack), insurance claim of >£100m, , Immutable Backups (Recommended), System Restoration Protocols, , Restoration of online shopping platform, Rebuilding supply chain operations, Customer communication campaigns, , Prioritization of Critical Applications (e.g., Payroll, Supplier Payments), Third-Party Support for Restoration, , Marketing campaigns for autumn/winter ranges, Product innovation (especially in food), Ocado joint venture optimization, , planned: ['Restart and ramp up online operations (June–July 2024)', 'Upgrade infrastructure and network connectivity', 'Enhance store/colleague technology', 'Improve supply chain systems'], status: Ongoing (accelerated investment phase), .
Regulatory Compliance
Were there any regulatory violations and fines imposed for each incident ?
Incident : Data Breach MAR528051425
Regulatory Notifications: Relevant authorities and law enforcement were notified
Incident : Ransomware MAR601070925
Regulatory Notifications: NCSC
Incident : Data Breach MAR451082725
Regulatory Notifications: ncsc_involvement: True, details: NCSC is investigating and providing sector-wide advice
Incident : Cyber Attack MAR628082925
Regulatory Notifications: Cyber Security and Resilience Bill (upcoming, 2025)
Incident : Ransomware MAR824090225
Regulatory Notifications: NCSC advised retailers to tighten cybersecurity; consumers urged to check bank activity
Incident : Unauthorized Access Attempt MAR843090225
Regulatory Notifications: NCSC engaged with M&S and Co-op
Incident : Ransomware (M&S) MAR5392253090725
Regulations Violated: Potential GDPR (Adidas, Co-op, M&S for PII exposure),
Regulatory Notifications: Likely (ICO for Adidas, Co-op, M&S)
Incident : Unauthorized Access Attempt MAR1662016090825
Legal Actions: U.S. prosecutors charged 5 alleged Scattered Spider members (November 2023),
Incident : ransomware MAR2902029102225
Regulatory Notifications: reported to NCSCmandatory reporting of personal data breaches to ICO within 72 hours (general requirement)
Incident : Cyber Attack MAR5032050110325
Regulatory Notifications: Likely (Transparency with regulators emphasized as best practice)
Incident : Data Breach MAR2433524112725
Regulations Violated: Potential GDPR (UK) violations for breaches reported to ICO
Regulatory Notifications: 1,381 incidents reported to UK ICO
Incident : data breach MAR28102028112725
Regulatory Notifications: U.K. National Cyber Security Centre (NCSC) involved
How does the company ensure compliance with regulatory requirements ?
Ensuring Regulatory Compliance: The company ensures compliance with regulatory requirements through U.S. prosecutors charged 5 alleged Scattered Spider members (November 2023), .
Lessons Learned and Recommendations
What lessons were learned from each incident ?
Incident : Ransomware MAR1041050625
Lessons Learned: Exposed gaps in patch management and incident response processes, Need for stronger network segmentation, Faster ransomware detection capabilities, Robust backup and recovery workflows
Incident : Ransomware MAR601070925
Lessons Learned: Importance of system segmentation and mandatory reporting of cyber incidents
Incident : Ransomware MAR847071225
Lessons Learned: Employees should be trained to recognize and report cyber threats promptly. Organizations should foster a culture of transparent and timely communication of cyber threats.
Incident : Ransomware, Data Theft MAR903072925
Lessons Learned: Proper training and a challenge process to validate the caller is who they say they are can prevent social engineering attacks. Using valid credentials and built-in tools makes it difficult for security teams to discern if they are compromised or not.
Incident : Cyber Attack MAR628082925
Lessons Learned: Proactive cybersecurity measures are significantly more cost-effective than reactive responses (up to 10x cost savings)., AI and Cybercrime-as-a-Service (CaaS) are democratizing cyber attacks, increasing threat sophistication., Cyber insurance is becoming a necessity, with premiums reducible by up to 75% through measures like XDR, MFA, and vulnerability scanning., Outsourcing cybersecurity improves IT efficiency, performance, and reduces downtime for 68% of businesses., Strong cybersecurity credentials can drive revenue growth and customer trust, especially as consumers become more cyber-aware.
Incident : Cyber-Attack MAR844090225
Lessons Learned: Smart buildings and operational technology (OT) are increasingly targeted by cybercriminals., Outdated systems (e.g., Windows 7) pose critical vulnerabilities in building infrastructure., Lack of proactive security measures risks severe operational and financial disruption., AI advancements and IoT proliferation will exacerbate cyber risks in building management.
Incident : Cyberattack MAR855090225
Lessons Learned: Retailers must assume they are targets and prepare accordingly., AI tools are accelerating the threat landscape, enabling low-skilled attackers to launch sophisticated campaigns (e.g., social engineering)., High downtime costs and customer data volumes make retail a prime target., Proactive measures (e.g., endpoint detection, staff training, MFA) are critical.
Incident : Ransomware (M&S) MAR5392253090725
Lessons Learned: Retailers must secure third-party vendors, smart building systems, and IoT devices to reduce attack surfaces. Rapid containment (e.g., Co-op’s IT shutdown) can mitigate ransomware deployment. Public-facing disruptions (e.g., payment outages) erode customer trust and revenue, highlighting the need for resilient backup systems and transparent communication.
Incident : ransomware MAR0762307092425
Lessons Learned: Isolated backups (e.g., offline/air-gapped storage) could mitigate ransomware impact but introduce cost and logistical challenges., Traditional backup solutions remain vulnerable to ransomware if not properly segmented or isolated., Physical security of offline backups (e.g., risk of theft) must be addressed alongside cybersecurity., Enterprises may need layered backup strategies to balance accessibility, cost, and resilience.
Incident : ransomware MAR2902029102225
Lessons Learned: Even significant cybersecurity investments (hundreds of millions) may not prevent determined attacks in large organizations., Third-party contractors can be a critical vulnerability., Rapid detection (e.g., Co-op's hours vs. M&S's days) mitigates impact., Segregated 'break glass' systems (Co-op's approach) are more sustainable than pen-and-paper fallbacks., Mandatory reporting of major cyber-attacks (beyond personal data breaches) could improve collective defense.
Incident : Data Breach MAR1993619102425
Lessons Learned: Proactive visibility across identity, access, and infrastructure is critical to detect threats early., Centralized log management and real-time threat detection are essential to limit breach impact., Zero Trust and network segmentation reduce lateral movement and blast radius., API and application monitoring must be prioritized to detect anomalous activity., Automated vulnerability management and patching reduce exposure to known exploits., Security culture and human resilience (e.g., phishing training) are vital to mitigate insider threats., Incident response plans must include immutable backups, clear communication protocols, and post-incident reviews., Transparency in breach disclosures helps retain customer trust and brand reputation.
Incident : Cyberattack MAR3792037102625
Lessons Learned: Vendor access equals attack surface; third-party personnel and processes must be treated as part of the cyber footprint., Social engineering (e.g., impersonation of help-desk staff) remains a critical vulnerability, bypassing technical defenses., Outsourcing does not absolve the client of accountability for cybersecurity, regulatory compliance, or business continuity., Contract renewal timelines should account for cyber risk assessments, especially for high-access vendors., Transparency in incident communication is essential to mitigate reputational damage and stakeholder speculation., Retailers must map 'critical vendors' and integrate them into cybersecurity strategies, not treat them as peripheral suppliers., Disruptions to digital platforms (e.g., online shopping) can have immediate bottom-line impacts, including market share loss to competitors.
Incident : Cyber Attack MAR5032050110325
Lessons Learned: Humans remain the weakest link in cybersecurity; advanced training (e.g., deepfake/phishing awareness) is critical., Proactive cyber resilience requires board-level engagement and accountability., Operational continuity relies on robust backups (cloud + third-party) and clear prioritization of critical systems., Transparent, timely communication with stakeholders (customers, investors, regulators) is essential to mitigate reputational damage., Third-party incident response retainers and cybersecurity providers can accelerate recovery and reduce burnout.
Incident : ransomware MAR1193411110425
Lessons Learned: Ransomware groups are evolving into cartel-like structures to consolidate power and resources., Affiliate recruitment and branded variants increase the scale and complexity of attacks., Partnerships with initial access brokers (e.g., Scattered Spider) amplify threat capabilities., Aggressive tactics (e.g., defacing rival leak sites) disrupt the cybercriminal ecosystem., Legacy ransomware code (e.g., Conti) continues to fuel new operations.
Incident : Cyber Attack MAR0102201110625
Lessons Learned: Critical importance of cybersecurity during peak retail periods (e.g., summer)., Need for resilient supply chain and inventory systems to prevent stock shortages., Customer loyalty is fragile; competitors can quickly capitalize on disruptions., Food innovation can offset losses in other segments (e.g., clothing)., Proactive investment in technology is necessary to prevent future incidents.
Incident : Data Breach MAR2433524112725
Lessons Learned: Seasonal peaks in incidents are minor; opportunistic attacks occur year-round., Continuous assurance is critical to prevent defense drift and detect attacks early., Balancing cyber resilience with profit-driven operations (e.g., Black Friday) is essential to avoid catastrophic disruptions., Consumer-targeted fraud (e.g., fake sites, phishing) spikes during holidays, requiring heightened vigilance.
What recommendations were made to prevent future incidents ?
Incident : Ransomware MAR1041050625
Recommendations: Deploy next-generation endpoint protection, Implement multi-factor authenticationDeploy next-generation endpoint protection, Implement multi-factor authentication
Incident : Ransomware MAR558070925
Recommendations: Greater transparency and cyberattack reporting
Incident : Ransomware MAR847071225
Recommendations: Implement training and attack simulation training to help employees recognize and respond to cyber threats appropriately.
Incident : Ransomware, Data Theft MAR903072925
Recommendations: Organisations must protect their virtualised assets through strong identity verification, VMware hardening, backup integrity, and continuous monitoring.
Incident : Cyber Attack MAR628082925
Recommendations: Shift from reactive to proactive cybersecurity strategies to mitigate financial and operational risks., Invest in advanced security measures such as XDR platforms, multi-factor authentication (MFA), and vulnerability scanning., Prioritize cyber insurance to comply with upcoming regulations (e.g., Cyber Security and Resilience Bill 2025) and reduce premiums through risk mitigation., Outsource cybersecurity to leverage external expertise, especially for SMEs lacking in-house capabilities., View cybersecurity as a revenue driver, not just a cost center, to gain competitive advantage and customer trust., Educate stakeholders on the financial and operational benefits of early cybersecurity investment.Shift from reactive to proactive cybersecurity strategies to mitigate financial and operational risks., Invest in advanced security measures such as XDR platforms, multi-factor authentication (MFA), and vulnerability scanning., Prioritize cyber insurance to comply with upcoming regulations (e.g., Cyber Security and Resilience Bill 2025) and reduce premiums through risk mitigation., Outsource cybersecurity to leverage external expertise, especially for SMEs lacking in-house capabilities., View cybersecurity as a revenue driver, not just a cost center, to gain competitive advantage and customer trust., Educate stakeholders on the financial and operational benefits of early cybersecurity investment.Shift from reactive to proactive cybersecurity strategies to mitigate financial and operational risks., Invest in advanced security measures such as XDR platforms, multi-factor authentication (MFA), and vulnerability scanning., Prioritize cyber insurance to comply with upcoming regulations (e.g., Cyber Security and Resilience Bill 2025) and reduce premiums through risk mitigation., Outsource cybersecurity to leverage external expertise, especially for SMEs lacking in-house capabilities., View cybersecurity as a revenue driver, not just a cost center, to gain competitive advantage and customer trust., Educate stakeholders on the financial and operational benefits of early cybersecurity investment.Shift from reactive to proactive cybersecurity strategies to mitigate financial and operational risks., Invest in advanced security measures such as XDR platforms, multi-factor authentication (MFA), and vulnerability scanning., Prioritize cyber insurance to comply with upcoming regulations (e.g., Cyber Security and Resilience Bill 2025) and reduce premiums through risk mitigation., Outsource cybersecurity to leverage external expertise, especially for SMEs lacking in-house capabilities., View cybersecurity as a revenue driver, not just a cost center, to gain competitive advantage and customer trust., Educate stakeholders on the financial and operational benefits of early cybersecurity investment.Shift from reactive to proactive cybersecurity strategies to mitigate financial and operational risks., Invest in advanced security measures such as XDR platforms, multi-factor authentication (MFA), and vulnerability scanning., Prioritize cyber insurance to comply with upcoming regulations (e.g., Cyber Security and Resilience Bill 2025) and reduce premiums through risk mitigation., Outsource cybersecurity to leverage external expertise, especially for SMEs lacking in-house capabilities., View cybersecurity as a revenue driver, not just a cost center, to gain competitive advantage and customer trust., Educate stakeholders on the financial and operational benefits of early cybersecurity investment.Shift from reactive to proactive cybersecurity strategies to mitigate financial and operational risks., Invest in advanced security measures such as XDR platforms, multi-factor authentication (MFA), and vulnerability scanning., Prioritize cyber insurance to comply with upcoming regulations (e.g., Cyber Security and Resilience Bill 2025) and reduce premiums through risk mitigation., Outsource cybersecurity to leverage external expertise, especially for SMEs lacking in-house capabilities., View cybersecurity as a revenue driver, not just a cost center, to gain competitive advantage and customer trust., Educate stakeholders on the financial and operational benefits of early cybersecurity investment.
Incident : Ransomware MAR824090225
Recommendations: Retailers urged to enhance cybersecurity (NCSC advisory), Consumers advised to monitor bank activity and update passwords, Multi-Factor Authentication (MFA) hardening recommendedRetailers urged to enhance cybersecurity (NCSC advisory), Consumers advised to monitor bank activity and update passwords, Multi-Factor Authentication (MFA) hardening recommendedRetailers urged to enhance cybersecurity (NCSC advisory), Consumers advised to monitor bank activity and update passwords, Multi-Factor Authentication (MFA) hardening recommended
Incident : Unauthorized Access Attempt MAR843090225
Recommendations: NCSC urges organizations to implement preventive measures and robust incident response/recovery plans, Retailers using SAP systems advised to review security posturesNCSC urges organizations to implement preventive measures and robust incident response/recovery plans, Retailers using SAP systems advised to review security postures
Incident : Cyber-Attack MAR844090225
Recommendations: Replace end-of-life operating systems (e.g., Windows 7) with supported, patched versions., Implement network segmentation for OT and IT systems in smart buildings., Enhance monitoring of building management systems, CCTV, and IoT devices., Develop incident response plans tailored to operational technology disruptions., Conduct regular vulnerability assessments for interconnected building systems., Raise awareness among facilities managers about cyber risks in digital environments.Replace end-of-life operating systems (e.g., Windows 7) with supported, patched versions., Implement network segmentation for OT and IT systems in smart buildings., Enhance monitoring of building management systems, CCTV, and IoT devices., Develop incident response plans tailored to operational technology disruptions., Conduct regular vulnerability assessments for interconnected building systems., Raise awareness among facilities managers about cyber risks in digital environments.Replace end-of-life operating systems (e.g., Windows 7) with supported, patched versions., Implement network segmentation for OT and IT systems in smart buildings., Enhance monitoring of building management systems, CCTV, and IoT devices., Develop incident response plans tailored to operational technology disruptions., Conduct regular vulnerability assessments for interconnected building systems., Raise awareness among facilities managers about cyber risks in digital environments.Replace end-of-life operating systems (e.g., Windows 7) with supported, patched versions., Implement network segmentation for OT and IT systems in smart buildings., Enhance monitoring of building management systems, CCTV, and IoT devices., Develop incident response plans tailored to operational technology disruptions., Conduct regular vulnerability assessments for interconnected building systems., Raise awareness among facilities managers about cyber risks in digital environments.Replace end-of-life operating systems (e.g., Windows 7) with supported, patched versions., Implement network segmentation for OT and IT systems in smart buildings., Enhance monitoring of building management systems, CCTV, and IoT devices., Develop incident response plans tailored to operational technology disruptions., Conduct regular vulnerability assessments for interconnected building systems., Raise awareness among facilities managers about cyber risks in digital environments.Replace end-of-life operating systems (e.g., Windows 7) with supported, patched versions., Implement network segmentation for OT and IT systems in smart buildings., Enhance monitoring of building management systems, CCTV, and IoT devices., Develop incident response plans tailored to operational technology disruptions., Conduct regular vulnerability assessments for interconnected building systems., Raise awareness among facilities managers about cyber risks in digital environments.
Incident : Cyberattack MAR855090225
Recommendations: Deploy endpoint protection and detection tools (e.g., EDR)., Implement multi-factor authentication (MFA) for administrative access., Develop and rehearse incident response plans with clear communication protocols., Train staff to recognize phishing and social engineering attacks., Monitor financial activity and update passwords (for consumers)., Assume breaches will occur and prepare for rapid response and recovery.Deploy endpoint protection and detection tools (e.g., EDR)., Implement multi-factor authentication (MFA) for administrative access., Develop and rehearse incident response plans with clear communication protocols., Train staff to recognize phishing and social engineering attacks., Monitor financial activity and update passwords (for consumers)., Assume breaches will occur and prepare for rapid response and recovery.Deploy endpoint protection and detection tools (e.g., EDR)., Implement multi-factor authentication (MFA) for administrative access., Develop and rehearse incident response plans with clear communication protocols., Train staff to recognize phishing and social engineering attacks., Monitor financial activity and update passwords (for consumers)., Assume breaches will occur and prepare for rapid response and recovery.Deploy endpoint protection and detection tools (e.g., EDR)., Implement multi-factor authentication (MFA) for administrative access., Develop and rehearse incident response plans with clear communication protocols., Train staff to recognize phishing and social engineering attacks., Monitor financial activity and update passwords (for consumers)., Assume breaches will occur and prepare for rapid response and recovery.Deploy endpoint protection and detection tools (e.g., EDR)., Implement multi-factor authentication (MFA) for administrative access., Develop and rehearse incident response plans with clear communication protocols., Train staff to recognize phishing and social engineering attacks., Monitor financial activity and update passwords (for consumers)., Assume breaches will occur and prepare for rapid response and recovery.Deploy endpoint protection and detection tools (e.g., EDR)., Implement multi-factor authentication (MFA) for administrative access., Develop and rehearse incident response plans with clear communication protocols., Train staff to recognize phishing and social engineering attacks., Monitor financial activity and update passwords (for consumers)., Assume breaches will occur and prepare for rapid response and recovery.
Incident : Ransomware (M&S) MAR5392253090725
Recommendations: Implement zero-trust architecture for third-party access., Audit and segment IoT/building management systems from critical networks., Develop playbooks for ransomware attacks, including offline payment contingencies., Enhance employee training on physical security (e.g., unguarded network sockets)., Conduct regular red-team exercises simulating supply-chain and RaaS attacks.Implement zero-trust architecture for third-party access., Audit and segment IoT/building management systems from critical networks., Develop playbooks for ransomware attacks, including offline payment contingencies., Enhance employee training on physical security (e.g., unguarded network sockets)., Conduct regular red-team exercises simulating supply-chain and RaaS attacks.Implement zero-trust architecture for third-party access., Audit and segment IoT/building management systems from critical networks., Develop playbooks for ransomware attacks, including offline payment contingencies., Enhance employee training on physical security (e.g., unguarded network sockets)., Conduct regular red-team exercises simulating supply-chain and RaaS attacks.Implement zero-trust architecture for third-party access., Audit and segment IoT/building management systems from critical networks., Develop playbooks for ransomware attacks, including offline payment contingencies., Enhance employee training on physical security (e.g., unguarded network sockets)., Conduct regular red-team exercises simulating supply-chain and RaaS attacks.Implement zero-trust architecture for third-party access., Audit and segment IoT/building management systems from critical networks., Develop playbooks for ransomware attacks, including offline payment contingencies., Enhance employee training on physical security (e.g., unguarded network sockets)., Conduct regular red-team exercises simulating supply-chain and RaaS attacks.
Incident : ransomware MAR0762307092425
Recommendations: Evaluate offline/air-gapped backup solutions (e.g., data diodes) for critical data, weighing costs against risk reduction., Implement multi-layered backup strategies to avoid single points of failure., Assess physical security measures for offline storage to mitigate theft risks., Regularly test backup integrity and recovery procedures to ensure effectiveness against ransomware., Consider distributing encrypted backup units across secure locations to reduce risk concentration.Evaluate offline/air-gapped backup solutions (e.g., data diodes) for critical data, weighing costs against risk reduction., Implement multi-layered backup strategies to avoid single points of failure., Assess physical security measures for offline storage to mitigate theft risks., Regularly test backup integrity and recovery procedures to ensure effectiveness against ransomware., Consider distributing encrypted backup units across secure locations to reduce risk concentration.Evaluate offline/air-gapped backup solutions (e.g., data diodes) for critical data, weighing costs against risk reduction., Implement multi-layered backup strategies to avoid single points of failure., Assess physical security measures for offline storage to mitigate theft risks., Regularly test backup integrity and recovery procedures to ensure effectiveness against ransomware., Consider distributing encrypted backup units across secure locations to reduce risk concentration.Evaluate offline/air-gapped backup solutions (e.g., data diodes) for critical data, weighing costs against risk reduction., Implement multi-layered backup strategies to avoid single points of failure., Assess physical security measures for offline storage to mitigate theft risks., Regularly test backup integrity and recovery procedures to ensure effectiveness against ransomware., Consider distributing encrypted backup units across secure locations to reduce risk concentration.Evaluate offline/air-gapped backup solutions (e.g., data diodes) for critical data, weighing costs against risk reduction., Implement multi-layered backup strategies to avoid single points of failure., Assess physical security measures for offline storage to mitigate theft risks., Regularly test backup integrity and recovery procedures to ensure effectiveness against ransomware., Consider distributing encrypted backup units across secure locations to reduce risk concentration.
Incident : ransomware MAR2902029102225
Recommendations: Mandate reporting of major cyber-attacks to NCSC (per Archie Norman)., Invest in detection systems for faster response (e.g., Co-op's hours-long detection)., Develop segregated backup systems for critical processes (Co-op's 'break glass' approach)., Enhance third-party risk management (given impersonation via contractor)., Evaluate cyber insurance coverage (Co-op chose detection over insurance; M&S relying on >£100m claim).Mandate reporting of major cyber-attacks to NCSC (per Archie Norman)., Invest in detection systems for faster response (e.g., Co-op's hours-long detection)., Develop segregated backup systems for critical processes (Co-op's 'break glass' approach)., Enhance third-party risk management (given impersonation via contractor)., Evaluate cyber insurance coverage (Co-op chose detection over insurance; M&S relying on >£100m claim).Mandate reporting of major cyber-attacks to NCSC (per Archie Norman)., Invest in detection systems for faster response (e.g., Co-op's hours-long detection)., Develop segregated backup systems for critical processes (Co-op's 'break glass' approach)., Enhance third-party risk management (given impersonation via contractor)., Evaluate cyber insurance coverage (Co-op chose detection over insurance; M&S relying on >£100m claim).Mandate reporting of major cyber-attacks to NCSC (per Archie Norman)., Invest in detection systems for faster response (e.g., Co-op's hours-long detection)., Develop segregated backup systems for critical processes (Co-op's 'break glass' approach)., Enhance third-party risk management (given impersonation via contractor)., Evaluate cyber insurance coverage (Co-op chose detection over insurance; M&S relying on >£100m claim).Mandate reporting of major cyber-attacks to NCSC (per Archie Norman)., Invest in detection systems for faster response (e.g., Co-op's hours-long detection)., Develop segregated backup systems for critical processes (Co-op's 'break glass' approach)., Enhance third-party risk management (given impersonation via contractor)., Evaluate cyber insurance coverage (Co-op chose detection over insurance; M&S relying on >£100m claim).
Incident : Data Breach MAR1993619102425
Recommendations: Adopt a visibility-first security posture with centralized log management and SIEM capabilities., Enforce least-privilege access, MFA, and continuous monitoring for identity and access controls., Implement network segmentation and Zero Trust principles to limit breach impact., Monitor API traffic and application behavior in real time for early threat detection., Automate vulnerability scanning and prioritize patching based on risk/exploitability., Invest in regular, scenario-based security training for employees to reduce human error., Develop and test incident response plans with tabletop exercises and immutable backups., Ensure transparent, timely communication with stakeholders, regulators, and customers during breaches., Conduct thorough post-incident root cause analyses to harden systems and share lessons industry-wide., Treat cybersecurity as a board-level priority tied to business continuity, not just an IT issue.Adopt a visibility-first security posture with centralized log management and SIEM capabilities., Enforce least-privilege access, MFA, and continuous monitoring for identity and access controls., Implement network segmentation and Zero Trust principles to limit breach impact., Monitor API traffic and application behavior in real time for early threat detection., Automate vulnerability scanning and prioritize patching based on risk/exploitability., Invest in regular, scenario-based security training for employees to reduce human error., Develop and test incident response plans with tabletop exercises and immutable backups., Ensure transparent, timely communication with stakeholders, regulators, and customers during breaches., Conduct thorough post-incident root cause analyses to harden systems and share lessons industry-wide., Treat cybersecurity as a board-level priority tied to business continuity, not just an IT issue.Adopt a visibility-first security posture with centralized log management and SIEM capabilities., Enforce least-privilege access, MFA, and continuous monitoring for identity and access controls., Implement network segmentation and Zero Trust principles to limit breach impact., Monitor API traffic and application behavior in real time for early threat detection., Automate vulnerability scanning and prioritize patching based on risk/exploitability., Invest in regular, scenario-based security training for employees to reduce human error., Develop and test incident response plans with tabletop exercises and immutable backups., Ensure transparent, timely communication with stakeholders, regulators, and customers during breaches., Conduct thorough post-incident root cause analyses to harden systems and share lessons industry-wide., Treat cybersecurity as a board-level priority tied to business continuity, not just an IT issue.Adopt a visibility-first security posture with centralized log management and SIEM capabilities., Enforce least-privilege access, MFA, and continuous monitoring for identity and access controls., Implement network segmentation and Zero Trust principles to limit breach impact., Monitor API traffic and application behavior in real time for early threat detection., Automate vulnerability scanning and prioritize patching based on risk/exploitability., Invest in regular, scenario-based security training for employees to reduce human error., Develop and test incident response plans with tabletop exercises and immutable backups., Ensure transparent, timely communication with stakeholders, regulators, and customers during breaches., Conduct thorough post-incident root cause analyses to harden systems and share lessons industry-wide., Treat cybersecurity as a board-level priority tied to business continuity, not just an IT issue.Adopt a visibility-first security posture with centralized log management and SIEM capabilities., Enforce least-privilege access, MFA, and continuous monitoring for identity and access controls., Implement network segmentation and Zero Trust principles to limit breach impact., Monitor API traffic and application behavior in real time for early threat detection., Automate vulnerability scanning and prioritize patching based on risk/exploitability., Invest in regular, scenario-based security training for employees to reduce human error., Develop and test incident response plans with tabletop exercises and immutable backups., Ensure transparent, timely communication with stakeholders, regulators, and customers during breaches., Conduct thorough post-incident root cause analyses to harden systems and share lessons industry-wide., Treat cybersecurity as a board-level priority tied to business continuity, not just an IT issue.Adopt a visibility-first security posture with centralized log management and SIEM capabilities., Enforce least-privilege access, MFA, and continuous monitoring for identity and access controls., Implement network segmentation and Zero Trust principles to limit breach impact., Monitor API traffic and application behavior in real time for early threat detection., Automate vulnerability scanning and prioritize patching based on risk/exploitability., Invest in regular, scenario-based security training for employees to reduce human error., Develop and test incident response plans with tabletop exercises and immutable backups., Ensure transparent, timely communication with stakeholders, regulators, and customers during breaches., Conduct thorough post-incident root cause analyses to harden systems and share lessons industry-wide., Treat cybersecurity as a board-level priority tied to business continuity, not just an IT issue.Adopt a visibility-first security posture with centralized log management and SIEM capabilities., Enforce least-privilege access, MFA, and continuous monitoring for identity and access controls., Implement network segmentation and Zero Trust principles to limit breach impact., Monitor API traffic and application behavior in real time for early threat detection., Automate vulnerability scanning and prioritize patching based on risk/exploitability., Invest in regular, scenario-based security training for employees to reduce human error., Develop and test incident response plans with tabletop exercises and immutable backups., Ensure transparent, timely communication with stakeholders, regulators, and customers during breaches., Conduct thorough post-incident root cause analyses to harden systems and share lessons industry-wide., Treat cybersecurity as a board-level priority tied to business continuity, not just an IT issue.Adopt a visibility-first security posture with centralized log management and SIEM capabilities., Enforce least-privilege access, MFA, and continuous monitoring for identity and access controls., Implement network segmentation and Zero Trust principles to limit breach impact., Monitor API traffic and application behavior in real time for early threat detection., Automate vulnerability scanning and prioritize patching based on risk/exploitability., Invest in regular, scenario-based security training for employees to reduce human error., Develop and test incident response plans with tabletop exercises and immutable backups., Ensure transparent, timely communication with stakeholders, regulators, and customers during breaches., Conduct thorough post-incident root cause analyses to harden systems and share lessons industry-wide., Treat cybersecurity as a board-level priority tied to business continuity, not just an IT issue.Adopt a visibility-first security posture with centralized log management and SIEM capabilities., Enforce least-privilege access, MFA, and continuous monitoring for identity and access controls., Implement network segmentation and Zero Trust principles to limit breach impact., Monitor API traffic and application behavior in real time for early threat detection., Automate vulnerability scanning and prioritize patching based on risk/exploitability., Invest in regular, scenario-based security training for employees to reduce human error., Develop and test incident response plans with tabletop exercises and immutable backups., Ensure transparent, timely communication with stakeholders, regulators, and customers during breaches., Conduct thorough post-incident root cause analyses to harden systems and share lessons industry-wide., Treat cybersecurity as a board-level priority tied to business continuity, not just an IT issue.Adopt a visibility-first security posture with centralized log management and SIEM capabilities., Enforce least-privilege access, MFA, and continuous monitoring for identity and access controls., Implement network segmentation and Zero Trust principles to limit breach impact., Monitor API traffic and application behavior in real time for early threat detection., Automate vulnerability scanning and prioritize patching based on risk/exploitability., Invest in regular, scenario-based security training for employees to reduce human error., Develop and test incident response plans with tabletop exercises and immutable backups., Ensure transparent, timely communication with stakeholders, regulators, and customers during breaches., Conduct thorough post-incident root cause analyses to harden systems and share lessons industry-wide., Treat cybersecurity as a board-level priority tied to business continuity, not just an IT issue.
Incident : Cyberattack MAR3792037102625
Recommendations: Implement stricter authentication for third-party vendor access (e.g., MFA, behavioral biometrics)., Conduct regular audits of vendor cybersecurity practices, especially for help-desk and privileged access roles., Develop incident response playbooks specifically for third-party breaches, including clear communication protocols., Integrate vendor risk management into enterprise cybersecurity frameworks, treating critical suppliers as extensions of internal systems., Enhance training for help-desk staff to detect and resist social engineering attacks (e.g., impersonation, phishing)., Review outsourcing contracts to include cybersecurity SLAs, liability clauses, and breach response obligations., Adopt zero-trust principles for vendor access, minimizing standing privileges and enforcing least-privilege access., Monitor dark web and underground forums for signs of compromised vendor credentials or targeted attacks.Implement stricter authentication for third-party vendor access (e.g., MFA, behavioral biometrics)., Conduct regular audits of vendor cybersecurity practices, especially for help-desk and privileged access roles., Develop incident response playbooks specifically for third-party breaches, including clear communication protocols., Integrate vendor risk management into enterprise cybersecurity frameworks, treating critical suppliers as extensions of internal systems., Enhance training for help-desk staff to detect and resist social engineering attacks (e.g., impersonation, phishing)., Review outsourcing contracts to include cybersecurity SLAs, liability clauses, and breach response obligations., Adopt zero-trust principles for vendor access, minimizing standing privileges and enforcing least-privilege access., Monitor dark web and underground forums for signs of compromised vendor credentials or targeted attacks.Implement stricter authentication for third-party vendor access (e.g., MFA, behavioral biometrics)., Conduct regular audits of vendor cybersecurity practices, especially for help-desk and privileged access roles., Develop incident response playbooks specifically for third-party breaches, including clear communication protocols., Integrate vendor risk management into enterprise cybersecurity frameworks, treating critical suppliers as extensions of internal systems., Enhance training for help-desk staff to detect and resist social engineering attacks (e.g., impersonation, phishing)., Review outsourcing contracts to include cybersecurity SLAs, liability clauses, and breach response obligations., Adopt zero-trust principles for vendor access, minimizing standing privileges and enforcing least-privilege access., Monitor dark web and underground forums for signs of compromised vendor credentials or targeted attacks.Implement stricter authentication for third-party vendor access (e.g., MFA, behavioral biometrics)., Conduct regular audits of vendor cybersecurity practices, especially for help-desk and privileged access roles., Develop incident response playbooks specifically for third-party breaches, including clear communication protocols., Integrate vendor risk management into enterprise cybersecurity frameworks, treating critical suppliers as extensions of internal systems., Enhance training for help-desk staff to detect and resist social engineering attacks (e.g., impersonation, phishing)., Review outsourcing contracts to include cybersecurity SLAs, liability clauses, and breach response obligations., Adopt zero-trust principles for vendor access, minimizing standing privileges and enforcing least-privilege access., Monitor dark web and underground forums for signs of compromised vendor credentials or targeted attacks.Implement stricter authentication for third-party vendor access (e.g., MFA, behavioral biometrics)., Conduct regular audits of vendor cybersecurity practices, especially for help-desk and privileged access roles., Develop incident response playbooks specifically for third-party breaches, including clear communication protocols., Integrate vendor risk management into enterprise cybersecurity frameworks, treating critical suppliers as extensions of internal systems., Enhance training for help-desk staff to detect and resist social engineering attacks (e.g., impersonation, phishing)., Review outsourcing contracts to include cybersecurity SLAs, liability clauses, and breach response obligations., Adopt zero-trust principles for vendor access, minimizing standing privileges and enforcing least-privilege access., Monitor dark web and underground forums for signs of compromised vendor credentials or targeted attacks.Implement stricter authentication for third-party vendor access (e.g., MFA, behavioral biometrics)., Conduct regular audits of vendor cybersecurity practices, especially for help-desk and privileged access roles., Develop incident response playbooks specifically for third-party breaches, including clear communication protocols., Integrate vendor risk management into enterprise cybersecurity frameworks, treating critical suppliers as extensions of internal systems., Enhance training for help-desk staff to detect and resist social engineering attacks (e.g., impersonation, phishing)., Review outsourcing contracts to include cybersecurity SLAs, liability clauses, and breach response obligations., Adopt zero-trust principles for vendor access, minimizing standing privileges and enforcing least-privilege access., Monitor dark web and underground forums for signs of compromised vendor credentials or targeted attacks.Implement stricter authentication for third-party vendor access (e.g., MFA, behavioral biometrics)., Conduct regular audits of vendor cybersecurity practices, especially for help-desk and privileged access roles., Develop incident response playbooks specifically for third-party breaches, including clear communication protocols., Integrate vendor risk management into enterprise cybersecurity frameworks, treating critical suppliers as extensions of internal systems., Enhance training for help-desk staff to detect and resist social engineering attacks (e.g., impersonation, phishing)., Review outsourcing contracts to include cybersecurity SLAs, liability clauses, and breach response obligations., Adopt zero-trust principles for vendor access, minimizing standing privileges and enforcing least-privilege access., Monitor dark web and underground forums for signs of compromised vendor credentials or targeted attacks.Implement stricter authentication for third-party vendor access (e.g., MFA, behavioral biometrics)., Conduct regular audits of vendor cybersecurity practices, especially for help-desk and privileged access roles., Develop incident response playbooks specifically for third-party breaches, including clear communication protocols., Integrate vendor risk management into enterprise cybersecurity frameworks, treating critical suppliers as extensions of internal systems., Enhance training for help-desk staff to detect and resist social engineering attacks (e.g., impersonation, phishing)., Review outsourcing contracts to include cybersecurity SLAs, liability clauses, and breach response obligations., Adopt zero-trust principles for vendor access, minimizing standing privileges and enforcing least-privilege access., Monitor dark web and underground forums for signs of compromised vendor credentials or targeted attacks.
Incident : Cyber Attack MAR5032050110325
Recommendations: Elevate cybersecurity to a board-level imperative with designated expertise (e.g., Virtual CISO)., Implement multi-layered defenses: MFA, adaptive behavioral WAFs, network segmentation, and enhanced monitoring., Conduct regular simulations of cyber incidents to test response plans and recovery timelines., Invest in employee training programs that address emerging threats (e.g., deepfakes, social engineering)., Establish incident response retainers for immediate access to expert assistance during breaches., Maintain separate third-party backups of cloud data to ensure rapid recovery of critical applications., Develop a communication strategy that prioritizes openness and honesty within 48 hours of an incident.Elevate cybersecurity to a board-level imperative with designated expertise (e.g., Virtual CISO)., Implement multi-layered defenses: MFA, adaptive behavioral WAFs, network segmentation, and enhanced monitoring., Conduct regular simulations of cyber incidents to test response plans and recovery timelines., Invest in employee training programs that address emerging threats (e.g., deepfakes, social engineering)., Establish incident response retainers for immediate access to expert assistance during breaches., Maintain separate third-party backups of cloud data to ensure rapid recovery of critical applications., Develop a communication strategy that prioritizes openness and honesty within 48 hours of an incident.Elevate cybersecurity to a board-level imperative with designated expertise (e.g., Virtual CISO)., Implement multi-layered defenses: MFA, adaptive behavioral WAFs, network segmentation, and enhanced monitoring., Conduct regular simulations of cyber incidents to test response plans and recovery timelines., Invest in employee training programs that address emerging threats (e.g., deepfakes, social engineering)., Establish incident response retainers for immediate access to expert assistance during breaches., Maintain separate third-party backups of cloud data to ensure rapid recovery of critical applications., Develop a communication strategy that prioritizes openness and honesty within 48 hours of an incident.Elevate cybersecurity to a board-level imperative with designated expertise (e.g., Virtual CISO)., Implement multi-layered defenses: MFA, adaptive behavioral WAFs, network segmentation, and enhanced monitoring., Conduct regular simulations of cyber incidents to test response plans and recovery timelines., Invest in employee training programs that address emerging threats (e.g., deepfakes, social engineering)., Establish incident response retainers for immediate access to expert assistance during breaches., Maintain separate third-party backups of cloud data to ensure rapid recovery of critical applications., Develop a communication strategy that prioritizes openness and honesty within 48 hours of an incident.Elevate cybersecurity to a board-level imperative with designated expertise (e.g., Virtual CISO)., Implement multi-layered defenses: MFA, adaptive behavioral WAFs, network segmentation, and enhanced monitoring., Conduct regular simulations of cyber incidents to test response plans and recovery timelines., Invest in employee training programs that address emerging threats (e.g., deepfakes, social engineering)., Establish incident response retainers for immediate access to expert assistance during breaches., Maintain separate third-party backups of cloud data to ensure rapid recovery of critical applications., Develop a communication strategy that prioritizes openness and honesty within 48 hours of an incident.Elevate cybersecurity to a board-level imperative with designated expertise (e.g., Virtual CISO)., Implement multi-layered defenses: MFA, adaptive behavioral WAFs, network segmentation, and enhanced monitoring., Conduct regular simulations of cyber incidents to test response plans and recovery timelines., Invest in employee training programs that address emerging threats (e.g., deepfakes, social engineering)., Establish incident response retainers for immediate access to expert assistance during breaches., Maintain separate third-party backups of cloud data to ensure rapid recovery of critical applications., Develop a communication strategy that prioritizes openness and honesty within 48 hours of an incident.Elevate cybersecurity to a board-level imperative with designated expertise (e.g., Virtual CISO)., Implement multi-layered defenses: MFA, adaptive behavioral WAFs, network segmentation, and enhanced monitoring., Conduct regular simulations of cyber incidents to test response plans and recovery timelines., Invest in employee training programs that address emerging threats (e.g., deepfakes, social engineering)., Establish incident response retainers for immediate access to expert assistance during breaches., Maintain separate third-party backups of cloud data to ensure rapid recovery of critical applications., Develop a communication strategy that prioritizes openness and honesty within 48 hours of an incident.
Incident : ransomware MAR1193411110425
Recommendations: Implement robust backup practices to mitigate encryption impacts., Restrict lateral movement via network segmentation., Monitor for unusual access to shared resources (e.g., SMB)., Apply consistent patching and endpoint protection., Conduct user awareness training to prevent initial access exploits., Defend against affiliate-based attacks by tracking emerging ransomware strains.Implement robust backup practices to mitigate encryption impacts., Restrict lateral movement via network segmentation., Monitor for unusual access to shared resources (e.g., SMB)., Apply consistent patching and endpoint protection., Conduct user awareness training to prevent initial access exploits., Defend against affiliate-based attacks by tracking emerging ransomware strains.Implement robust backup practices to mitigate encryption impacts., Restrict lateral movement via network segmentation., Monitor for unusual access to shared resources (e.g., SMB)., Apply consistent patching and endpoint protection., Conduct user awareness training to prevent initial access exploits., Defend against affiliate-based attacks by tracking emerging ransomware strains.Implement robust backup practices to mitigate encryption impacts., Restrict lateral movement via network segmentation., Monitor for unusual access to shared resources (e.g., SMB)., Apply consistent patching and endpoint protection., Conduct user awareness training to prevent initial access exploits., Defend against affiliate-based attacks by tracking emerging ransomware strains.Implement robust backup practices to mitigate encryption impacts., Restrict lateral movement via network segmentation., Monitor for unusual access to shared resources (e.g., SMB)., Apply consistent patching and endpoint protection., Conduct user awareness training to prevent initial access exploits., Defend against affiliate-based attacks by tracking emerging ransomware strains.Implement robust backup practices to mitigate encryption impacts., Restrict lateral movement via network segmentation., Monitor for unusual access to shared resources (e.g., SMB)., Apply consistent patching and endpoint protection., Conduct user awareness training to prevent initial access exploits., Defend against affiliate-based attacks by tracking emerging ransomware strains.
Incident : Cyber Attack MAR0102201110625
Recommendations: Implement multi-layered cybersecurity defenses, including real-time threat detection., Conduct regular stress tests for e-commerce and supply chain systems., Develop a crisis communication plan to retain customer trust during disruptions., Accelerate digital transformation to improve operational agility., Leverage data analytics to predict and mitigate stock availability risks., Strengthen partnerships (e.g., Ocado) to diversify revenue streams.Implement multi-layered cybersecurity defenses, including real-time threat detection., Conduct regular stress tests for e-commerce and supply chain systems., Develop a crisis communication plan to retain customer trust during disruptions., Accelerate digital transformation to improve operational agility., Leverage data analytics to predict and mitigate stock availability risks., Strengthen partnerships (e.g., Ocado) to diversify revenue streams.Implement multi-layered cybersecurity defenses, including real-time threat detection., Conduct regular stress tests for e-commerce and supply chain systems., Develop a crisis communication plan to retain customer trust during disruptions., Accelerate digital transformation to improve operational agility., Leverage data analytics to predict and mitigate stock availability risks., Strengthen partnerships (e.g., Ocado) to diversify revenue streams.Implement multi-layered cybersecurity defenses, including real-time threat detection., Conduct regular stress tests for e-commerce and supply chain systems., Develop a crisis communication plan to retain customer trust during disruptions., Accelerate digital transformation to improve operational agility., Leverage data analytics to predict and mitigate stock availability risks., Strengthen partnerships (e.g., Ocado) to diversify revenue streams.Implement multi-layered cybersecurity defenses, including real-time threat detection., Conduct regular stress tests for e-commerce and supply chain systems., Develop a crisis communication plan to retain customer trust during disruptions., Accelerate digital transformation to improve operational agility., Leverage data analytics to predict and mitigate stock availability risks., Strengthen partnerships (e.g., Ocado) to diversify revenue streams.Implement multi-layered cybersecurity defenses, including real-time threat detection., Conduct regular stress tests for e-commerce and supply chain systems., Develop a crisis communication plan to retain customer trust during disruptions., Accelerate digital transformation to improve operational agility., Leverage data analytics to predict and mitigate stock availability risks., Strengthen partnerships (e.g., Ocado) to diversify revenue streams.
Incident : Data Breach MAR2433524112725
Recommendations: Adopt continuous assurance to monitor defense posture and prevent vulnerabilities., Prioritize detection/response for high-impact threats (ransomware, phishing, misconfigurations)., Double-check resilience during peak sales periods (e.g., Black Friday, Christmas)., Educate consumers on recognizing fake e-commerce sites and phishing scams (e.g., typosquatting, fake trust badges)., Verify delivery notifications directly with carriers to avoid falling for fake tracking messages.Adopt continuous assurance to monitor defense posture and prevent vulnerabilities., Prioritize detection/response for high-impact threats (ransomware, phishing, misconfigurations)., Double-check resilience during peak sales periods (e.g., Black Friday, Christmas)., Educate consumers on recognizing fake e-commerce sites and phishing scams (e.g., typosquatting, fake trust badges)., Verify delivery notifications directly with carriers to avoid falling for fake tracking messages.Adopt continuous assurance to monitor defense posture and prevent vulnerabilities., Prioritize detection/response for high-impact threats (ransomware, phishing, misconfigurations)., Double-check resilience during peak sales periods (e.g., Black Friday, Christmas)., Educate consumers on recognizing fake e-commerce sites and phishing scams (e.g., typosquatting, fake trust badges)., Verify delivery notifications directly with carriers to avoid falling for fake tracking messages.Adopt continuous assurance to monitor defense posture and prevent vulnerabilities., Prioritize detection/response for high-impact threats (ransomware, phishing, misconfigurations)., Double-check resilience during peak sales periods (e.g., Black Friday, Christmas)., Educate consumers on recognizing fake e-commerce sites and phishing scams (e.g., typosquatting, fake trust badges)., Verify delivery notifications directly with carriers to avoid falling for fake tracking messages.Adopt continuous assurance to monitor defense posture and prevent vulnerabilities., Prioritize detection/response for high-impact threats (ransomware, phishing, misconfigurations)., Double-check resilience during peak sales periods (e.g., Black Friday, Christmas)., Educate consumers on recognizing fake e-commerce sites and phishing scams (e.g., typosquatting, fake trust badges)., Verify delivery notifications directly with carriers to avoid falling for fake tracking messages.
Incident : data breach MAR28102028112725
Recommendations: customers advised to reset passwords, vigilance against phishing/social engineering attacks, NCSC guidance for mitigating future ransomware attackscustomers advised to reset passwords, vigilance against phishing/social engineering attacks, NCSC guidance for mitigating future ransomware attackscustomers advised to reset passwords, vigilance against phishing/social engineering attacks, NCSC guidance for mitigating future ransomware attacks
What are the key lessons learned from past incidents ?
Key Lessons Learned: The key lessons learned from past incidents are Exposed gaps in patch management and incident response processes,Need for stronger network segmentation,Faster ransomware detection capabilities,Robust backup and recovery workflowsImportance of system segmentation and mandatory reporting of cyber incidentsEmployees should be trained to recognize and report cyber threats promptly. Organizations should foster a culture of transparent and timely communication of cyber threats.Proper training and a challenge process to validate the caller is who they say they are can prevent social engineering attacks. Using valid credentials and built-in tools makes it difficult for security teams to discern if they are compromised or not.Proactive cybersecurity measures are significantly more cost-effective than reactive responses (up to 10x cost savings).,AI and Cybercrime-as-a-Service (CaaS) are democratizing cyber attacks, increasing threat sophistication.,Cyber insurance is becoming a necessity, with premiums reducible by up to 75% through measures like XDR, MFA, and vulnerability scanning.,Outsourcing cybersecurity improves IT efficiency, performance, and reduces downtime for 68% of businesses.,Strong cybersecurity credentials can drive revenue growth and customer trust, especially as consumers become more cyber-aware.Smart buildings and operational technology (OT) are increasingly targeted by cybercriminals.,Outdated systems (e.g., Windows 7) pose critical vulnerabilities in building infrastructure.,Lack of proactive security measures risks severe operational and financial disruption.,AI advancements and IoT proliferation will exacerbate cyber risks in building management.Retailers must assume they are targets and prepare accordingly.,AI tools are accelerating the threat landscape, enabling low-skilled attackers to launch sophisticated campaigns (e.g., social engineering).,High downtime costs and customer data volumes make retail a prime target.,Proactive measures (e.g., endpoint detection, staff training, MFA) are critical.Retailers must secure third-party vendors, smart building systems, and IoT devices to reduce attack surfaces. Rapid containment (e.g., Co-op’s IT shutdown) can mitigate ransomware deployment. Public-facing disruptions (e.g., payment outages) erode customer trust and revenue, highlighting the need for resilient backup systems and transparent communication.Isolated backups (e.g., offline/air-gapped storage) could mitigate ransomware impact but introduce cost and logistical challenges.,Traditional backup solutions remain vulnerable to ransomware if not properly segmented or isolated.,Physical security of offline backups (e.g., risk of theft) must be addressed alongside cybersecurity.,Enterprises may need layered backup strategies to balance accessibility, cost, and resilience.Even significant cybersecurity investments (hundreds of millions) may not prevent determined attacks in large organizations.,Third-party contractors can be a critical vulnerability.,Rapid detection (e.g., Co-op's hours vs. M&S's days) mitigates impact.,Segregated 'break glass' systems (Co-op's approach) are more sustainable than pen-and-paper fallbacks.,Mandatory reporting of major cyber-attacks (beyond personal data breaches) could improve collective defense.Proactive visibility across identity, access, and infrastructure is critical to detect threats early.,Centralized log management and real-time threat detection are essential to limit breach impact.,Zero Trust and network segmentation reduce lateral movement and blast radius.,API and application monitoring must be prioritized to detect anomalous activity.,Automated vulnerability management and patching reduce exposure to known exploits.,Security culture and human resilience (e.g., phishing training) are vital to mitigate insider threats.,Incident response plans must include immutable backups, clear communication protocols, and post-incident reviews.,Transparency in breach disclosures helps retain customer trust and brand reputation.Vendor access equals attack surface; third-party personnel and processes must be treated as part of the cyber footprint.,Social engineering (e.g., impersonation of help-desk staff) remains a critical vulnerability, bypassing technical defenses.,Outsourcing does not absolve the client of accountability for cybersecurity, regulatory compliance, or business continuity.,Contract renewal timelines should account for cyber risk assessments, especially for high-access vendors.,Transparency in incident communication is essential to mitigate reputational damage and stakeholder speculation.,Retailers must map 'critical vendors' and integrate them into cybersecurity strategies, not treat them as peripheral suppliers.,Disruptions to digital platforms (e.g., online shopping) can have immediate bottom-line impacts, including market share loss to competitors.Humans remain the weakest link in cybersecurity; advanced training (e.g., deepfake/phishing awareness) is critical.,Proactive cyber resilience requires board-level engagement and accountability.,Operational continuity relies on robust backups (cloud + third-party) and clear prioritization of critical systems.,Transparent, timely communication with stakeholders (customers, investors, regulators) is essential to mitigate reputational damage.,Third-party incident response retainers and cybersecurity providers can accelerate recovery and reduce burnout.Ransomware groups are evolving into cartel-like structures to consolidate power and resources.,Affiliate recruitment and branded variants increase the scale and complexity of attacks.,Partnerships with initial access brokers (e.g., Scattered Spider) amplify threat capabilities.,Aggressive tactics (e.g., defacing rival leak sites) disrupt the cybercriminal ecosystem.,Legacy ransomware code (e.g., Conti) continues to fuel new operations.Critical importance of cybersecurity during peak retail periods (e.g., summer).,Need for resilient supply chain and inventory systems to prevent stock shortages.,Customer loyalty is fragile; competitors can quickly capitalize on disruptions.,Food innovation can offset losses in other segments (e.g., clothing).,Proactive investment in technology is necessary to prevent future incidents.Seasonal peaks in incidents are minor; opportunistic attacks occur year-round.,Continuous assurance is critical to prevent defense drift and detect attacks early.,Balancing cyber resilience with profit-driven operations (e.g., Black Friday) is essential to avoid catastrophic disruptions.,Consumer-targeted fraud (e.g., fake sites, phishing) spikes during holidays, requiring heightened vigilance.
What recommendations has the company implemented to improve cybersecurity ?
Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Accelerate digital transformation to improve operational agility., Prioritize detection/response for high-impact threats (ransomware, phishing, misconfigurations)., Educate consumers on recognizing fake e-commerce sites and phishing scams (e.g., typosquatting, fake trust badges)., Develop a crisis communication plan to retain customer trust during disruptions., Double-check resilience during peak sales periods (e.g., Black Friday, Christmas)., Verify delivery notifications directly with carriers to avoid falling for fake tracking messages., Leverage data analytics to predict and mitigate stock availability risks., Strengthen partnerships (e.g., Ocado) to diversify revenue streams., Conduct regular audits of vendor cybersecurity practices, especially for help-desk and privileged access roles., Implement multi-factor authentication, Review outsourcing contracts to include cybersecurity SLAs, liability clauses, and breach response obligations., Implement stricter authentication for third-party vendor access (e.g., MFA, behavioral biometrics)., Organisations must protect their virtualised assets through strong identity verification, VMware hardening, backup integrity, and continuous monitoring., Monitor dark web and underground forums for signs of compromised vendor credentials or targeted attacks., Conduct regular stress tests for e-commerce and supply chain systems., Adopt zero-trust principles for vendor access, minimizing standing privileges and enforcing least-privilege access., Develop incident response playbooks specifically for third-party breaches, including clear communication protocols., Adopt continuous assurance to monitor defense posture and prevent vulnerabilities., Deploy next-generation endpoint protection, Enhance training for help-desk staff to detect and resist social engineering attacks (e.g., impersonation, phishing)., Implement training and attack simulation training to help employees recognize and respond to cyber threats appropriately., Integrate vendor risk management into enterprise cybersecurity frameworks, treating critical suppliers as extensions of internal systems., Implement multi-layered cybersecurity defenses and including real-time threat detection..
References
Where can I find more information about each incident ?
Incident : Data Breach MAR528051425
Source: Marks & Spencer
Incident : Ransomware MAR356052125
Source: BleepingComputer
Incident : Cyberattack MAR900062025
Source: TechRadar Pro
Incident : Ransomware MAR558070925
Source: Reuters
Incident : Ransomware MAR847071225
Source: Cohesity Survey
Incident : Ransomware MAR956072325
Source: BleepingComputer
Incident : Ransomware, Data Theft MAR903072925
Source: Google’s Threat Intelligence Group (GTIG)
Date Accessed: mid-2025
Incident : Ransomware, Data Theft MAR903072925
Source: Thomas Richards, Infrastructure Security Practice Director at Black Duck
Incident : Data Breach MAR451082725
Source: Marks and Spencer Public Statement
Date Accessed: 2024-05-28
Incident : Data Breach MAR451082725
Source: UK National Cyber Security Centre (NCSC)
Date Accessed: 2024-05-28
Incident : Cyber Attack MAR628082925
Source: ESET (Jake Moore, Global Cybersecurity Advisor)
Incident : Ransomware MAR824090225
Source: Al Jazeera
Incident : Ransomware MAR824090225
Source: The Guardian (Secureworks interview)
Incident : Ransomware MAR824090225
Source: UK National Cyber Security Centre (NCSC)
Incident : Unauthorized Access Attempt MAR843090225
Source: Sky News
Incident : Cyber-Attack MAR844090225
Source: Royal Institution of Chartered Surveyors (Rics) Report
Incident : Cyberattack MAR855090225
Source: TechRadar Pro
Incident : Cyberattack MAR855090225
Source: SonicWall (Spencer Starkey, Executive VP of EMEA)
Incident : Cyberattack MAR855090225
Source: National Cyber Security Centre (NCSC) - Dr. Richard Horne
Incident : Cyberattack MAR855090225
Source: Ex-NSA Cyber Chief - Cody Barrow
Incident : Ransomware (M&S) MAR5392253090725
Source: Dynatrace & FreedomPay Report
Incident : Ransomware (M&S) MAR5392253090725
Source: Royal Institution of Chartered Surveyors (RICS)
URL: https://www.theguardian.com/technology/2024/may/XX/rics-cyber-attacks-smart-buildings
Incident : Ransomware (M&S) MAR5392253090725
Source: M&S Public Disclosure
Incident : Ransomware (M&S) MAR5392253090725
Source: Harrods Statement (1 May 2024)
Incident : Ransomware (M&S) MAR5392253090725
Source: Adidas Data Breach Notice (May 2024)
Incident : Unauthorized Access Attempt MAR1662016090825
Source: BleepingComputer
Incident : Unauthorized Access Attempt MAR1662016090825
Source: Darktrace (Nathaniel Jones, VP of Security & AI Strategy)
Incident : ransomware MAR0762307092425
Source: TechRadar Pro
Incident : ransomware MAR0762307092425
Source: Blocksandfiles (interview with Matt Peterman and Nino Eškić)
Incident : ransomware MAR2902029102225
Source: The Guardian
Incident : ransomware MAR2902029102225
Source: UK Parliament Business and Trade Subcommittee on Economic Security, Arms and Export Controls
Incident : Data Breach MAR1993619102425
Source: Security Journal UK (October 2025 Edition)
Incident : Cyberattack MAR3792037102625
Source: Media reports on M&S cyberattack and TCS contract termination
Incident : Cyberattack MAR3792037102625
Source: Statements from M&S CEO Stuart Machin to UK Parliament
Incident : Cyberattack MAR3792037102625
Source: TCS public statements on the incident
Incident : Cyber Attack MAR5032050110325
Source: TechRadar Pro - Expert Insights
Incident : Cyber Attack MAR5032050110325
Source: Duke’s CFO Global Business Outlook
Incident : ransomware MAR1193411110425
Source: Acronis Threat Research Unit (TRU)
Incident : ransomware MAR1193411110425
Source: BleepingComputer or similar cybersecurity news outlet (implied)
Incident : Cyber Attack MAR0102201110625
Source: Marks & Spencer Half-Year Results H1 2025
Date Accessed: 2025-11-05
Incident : Data Breach MAR2433524112725
Source: Huntsman Security Analysis (ICO Data Q3 2024–Q2 2025)
Incident : Data Breach MAR2433524112725
Source: Semperis Report on Ransomware Timing
Incident : Data Breach MAR2433524112725
Source: ReliaQuest (Scattered Lapsus$ Hunters Telegram Post)
Date Accessed: 2025-11-01
Incident : Data Breach MAR2433524112725
Source: UK NCSC (Festive Fraud Trends)
Incident : Data Breach MAR2433524112725
Source: Action Fraud Data (£11.8m Fraud Loss)
Incident : Data Breach MAR2433524112725
Source: CloudSEK (Fake E-commerce Sites Analysis)
Incident : data breach MAR28102028112725
Source: Marks and Spencer Trading Update (CEO Stuart Machin)
Date Accessed: 2024-05-28
Incident : data breach MAR28102028112725
Source: U.K. National Cyber Security Centre (NCSC) Statement
Date Accessed: 2024-05
Incident : data breach MAR28102028112725
Source: NCC Group (Matt Hull, Head of Threat Intelligence)
Date Accessed: 2024-05
Incident : Cyberattack MAR19103519112725
Source: Marks & Spencer (M&S) Statement to London Stock Exchange
Date Accessed: 2024-05-29T00:00:00Z
Incident : Cyberattack MAR19103519112725
Source: Reuters / Media Reports on UK Retail Cyberattacks
Date Accessed: 2024-05-29T00:00:00Z
Where can stakeholders find additional resources on cybersecurity best practices ?
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Marks & Spencer, and Source: BleepingComputer, and Source: TechRadar Pro, and Source: Reuters, and Source: UK Parliament hearing on July 8Date Accessed: 2023-07-08, and Source: Cohesity Survey, and Source: BlackFog ReportDate Accessed: 2025-07-16, and Source: BleepingComputer, and Source: Google’s Threat Intelligence Group (GTIG)Date Accessed: mid-2025, and Source: Thomas Richards, Infrastructure Security Practice Director at Black Duck, and Source: Marks and Spencer Public StatementDate Accessed: 2024-05-28, and Source: UK National Cyber Security Centre (NCSC)Url: https://www.ncsc.gov.ukDate Accessed: 2024-05-28, and Source: TechRadar ProUrl: https://www.techradar.com, and Source: ESET (Jake Moore, Global Cybersecurity Advisor), and Source: Al Jazeera, and Source: The Guardian (Secureworks interview), and Source: UK National Cyber Security Centre (NCSC), and Source: The GuardianUrl: https://www.theguardian.com/business/2024/may/02/harrods-hit-by-cyber-attack-days-after-marks-spencer-and-co-opDate Accessed: 2024-05-02, and Source: Sky News, and Source: The GuardianUrl: https://www.theguardian.com/business/2024/jun/10/uk-businesses-cyber-attack-risk-smart-buildings-ricsDate Accessed: 2024-06-10, and Source: Royal Institution of Chartered Surveyors (Rics) Report, and Source: TechRadar Pro, and Source: SonicWall (Spencer Starkey, Executive VP of EMEA), and Source: National Cyber Security Centre (NCSC) - Dr. Richard Horne, and Source: Ex-NSA Cyber Chief - Cody Barrow, and Source: Dynatrace & FreedomPay Report, and Source: Royal Institution of Chartered Surveyors (RICS)Url: https://www.theguardian.com/technology/2024/may/XX/rics-cyber-attacks-smart-buildings, and Source: M&S Public Disclosure, and Source: Harrods Statement (1 May 2024), and Source: Adidas Data Breach Notice (May 2024), and Source: ReutersDate Accessed: 2024-06-19, and Source: BleepingComputer, and Source: Darktrace (Nathaniel Jones, VP of Security & AI Strategy), and Source: TechRadar Pro, and Source: Blocksandfiles (interview with Matt Peterman and Nino Eškić), and Source: The GuardianUrl: https://www.theguardian.com/business/2024/jun/11/marks-spencer-cyber-attack-online-store-archie-norman, and Source: UK Parliament Business and Trade Subcommittee on Economic Security, Arms and Export Controls, and Source: Security Journal UK (October 2025 Edition)Url: https://www.securityjournaluk.com, and Source: Media reports on M&S cyberattack and TCS contract termination, and Source: Statements from M&S CEO Stuart Machin to UK Parliament, and Source: TCS public statements on the incident, and Source: TechRadar Pro - Expert InsightsUrl: https://www.techradar.com/pro, and Source: Duke’s CFO Global Business Outlook, and Source: Acronis Threat Research Unit (TRU), and Source: BleepingComputer or similar cybersecurity news outlet (implied), and Source: Marks & Spencer Half-Year Results H1 2025Date Accessed: 2025-11-05, and Source: Huntsman Security Analysis (ICO Data Q3 2024–Q2 2025), and Source: Semperis Report on Ransomware Timing, and Source: ReliaQuest (Scattered Lapsus$ Hunters Telegram Post)Date Accessed: 2025-11-01, and Source: UK NCSC (Festive Fraud Trends), and Source: Action Fraud Data (£11.8m Fraud Loss), and Source: CloudSEK (Fake E-commerce Sites Analysis), and Source: Marks and Spencer Trading Update (CEO Stuart Machin)Date Accessed: 2024-05-28, and Source: U.K. National Cyber Security Centre (NCSC) StatementDate Accessed: 2024-05, and Source: NCC Group (Matt Hull, Head of Threat Intelligence)Date Accessed: 2024-05, and Source: Marks & Spencer (M&S) Statement to London Stock ExchangeDate Accessed: 2024-05-29T00:00:00Z, and Source: Reuters / Media Reports on UK Retail CyberattacksDate Accessed: 2024-05-29T00:00:00Z.
Investigation Status
What is the current status of the investigation for each incident ?
Incident : Ransomware MAR356052125
Investigation Status: Ongoing
Incident : Cyberattack MAR900062025
Investigation Status: Ongoing
Incident : Ransomware MAR558070925
Investigation Status: Ongoing
Incident : Ransomware MAR601070925
Investigation Status: Ongoing
Incident : Data Breach MAR451082725
Investigation Status: Ongoing (NCSC and law enforcement involved)
Incident : Cyber Attack MAR628082925
Investigation Status: Ongoing (general trend analysis; specific incidents may vary)
Incident : Ransomware MAR824090225
Investigation Status: Ongoing (Metropolitan Police and NCSC investigating as of 2024-04-30)
Incident : Unauthorized Access Attempt MAR843090225
Investigation Status: Ongoing (NCSC, Metropolitan Police, NCA involved)
Incident : Cyber-Attack MAR844090225
Investigation Status: Ongoing (per Rics report warnings)
Incident : Cyberattack MAR855090225
Investigation Status: Ongoing (no official link confirmed between incidents; more details may emerge)
Incident : Ransomware (M&S) MAR5392253090725
Investigation Status: ['Ongoing (M&S)', 'Completed (Adidas, Co-op, Harrods)', 'Unconfirmed (H&M)']
Incident : Unauthorized Access Attempt MAR1662016090825
Investigation Status: ['Ongoing (NCSC, NCA, Metropolitan Police involved)']
Incident : ransomware MAR2902029102225
Investigation Status: ongoing (as of disclosure; M&S in 'rebuild mode')
Incident : Data Breach MAR1993619102425
Investigation Status: Ongoing (Louis Vuitton in early disclosure; M&S and Co-op likely concluded)
Incident : Cyberattack MAR3792037102625
Investigation Status: Ongoing (as of July 2025; TCS maintains no compromise of its systems)
Incident : ransomware MAR1193411110425
Investigation Status: ongoing (as of latest reports)
Incident : Cyber Attack MAR0102201110625
Investigation Status: Ongoing (implied by planned cybersecurity investments)
Incident : Data Breach MAR2433524112725
Investigation Status: Ongoing (ICO reports; seasonal threats monitored)
Incident : data breach MAR28102028112725
Investigation Status: ongoing (NCSC assisting with investigation)
Incident : Cyberattack MAR19103519112725
Investigation Status: {'internal': 'Ongoing (accelerated infrastructure upgrades)', 'law_enforcement': 'Ongoing (UK police investigating potential links to other retail attacks)'}
How does the company communicate the status of incident investigations to stakeholders ?
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Letter To Customers, Affected customers were notified, Calling For Greater Transparency And Cyberattack Reporting, Media channels, including BBC., Initial Public Disclosure (2024-04-21), Limited Updates (Last Statement On 2024-04-25), Harrods Assured Customers Of Normal Operations, Harrods: Public Statement (No Customer Action Required), M&S: Updates On Job Site ('Working Hard To Be Back Online'), Co-Op: Internal Staff Warnings, Public Disclosure Via Rics Report, Media Coverage (The Guardian), Public Disclosures (All), Customer Apologies (H&M, M&S), Public Statements (Both Companies), Transparency With Mps During Subcommittee Hearing, No Public Disclosure Of Ransom Interactions, Transparency In Public Disclosures (Recommended), Stakeholder/Regulator Notifications, Public Disclosure Of Incident, Statements To Mps (Uk Parliament), Investor Updates, Media Responses, Timely Digital Communications By Ceo (Marks And Spencer), Transparency With Regulators/Investors, Public Disclosure Via Half-Year Results (Nov 5, 2025), Media Statements On Recovery Plans, Public advisories (e.g., NCSC warnings on fraud trends), Trading Update From Ceo Stuart Machin, Customer Note From Operations Director Jayne Wall, Faq Page For Affected Customers, public statements: london stock exchange filing (wednesday) and customer advisories (data compromise warning)..
Stakeholder and Customer Advisories
Were there any advisories issued to stakeholders or customers for each incident ?
Incident : Data Breach MAR528051425
Customer Advisories: Reset passwords
Incident : Data Breach MAR451082725
Stakeholder Advisories: NCSC is providing advice to the retail sector and wider economy
Customer Advisories: Customers advised to reset passwords on next login; no further action required
Incident : Cyber Attack MAR628082925
Stakeholder Advisories: Businesses urged to adopt proactive cybersecurity measures to mitigate risks from evolving threats (AI, nation-states, CaaS).
Customer Advisories: Customers advised to monitor communications from affected retailers for potential data breach notifications or protective measures.
Incident : Ransomware MAR824090225
Stakeholder Advisories: NCSC urged retailers to tighten cybersecurity; no specific advisories from M&S/Harrods
Customer Advisories: M&S warned of service disruptions; Harrods assured normal operations
Incident : Unauthorized Access Attempt MAR843090225
Stakeholder Advisories: Ncsc Warns Retailers To Bolster Defenses; No Specific Stakeholder Advisories Detailed.
Customer Advisories: Harrods: no action required per statement; M&S/Co-op: no public customer advisories
Incident : Cyber-Attack MAR844090225
Stakeholder Advisories: Rics Urges Businesses To Address Digital Risks In Building Operations To Avoid 'Sleepwalking' Into Attacks..
Customer Advisories: Marks & Spencer likely issued advisories during the 7-week website outage (details unspecified).
Incident : Cyberattack MAR855090225
Stakeholder Advisories: Security Teams Urged To Be 'Ultra Vigilant.', Ncsc Warns Attacks Should Serve As A 'Wake-Up Call' For All Organizations., Experts Recommend Presuming Targeting Is Inevitable And Preparing Accordingly..
Customer Advisories: Update passwords and monitor financial activity for signs of fraud.Watch for scams exploiting recent breaches.
Incident : Ransomware (M&S) MAR5392253090725
Stakeholder Advisories: Market Updates (M&S £300M Loss).
Customer Advisories: Apologies and service updates (H&M, M&S, Co-op)Data breach notifications (Adidas, Co-op)
Incident : Unauthorized Access Attempt MAR1662016090825
Customer Advisories: Public statements confirming operational status (Co-op)No specific advisories mentioned (M&S)
Incident : ransomware MAR2902029102225
Stakeholder Advisories: Advice To Businesses: Prepare To Operate On Pen-And-Paper (M&S) Or Segregated Backup Systems (Co-Op)..
Incident : Cyberattack MAR3792037102625
Stakeholder Advisories: M&S Updates To Investors And Mps, Tcs Communications To Clients And Media.
Customer Advisories: M&S notifications about service disruptionsApologies for order delays and stock shortages
Incident : Cyber Attack MAR5032050110325
Stakeholder Advisories: Ceo-Led Digital Communications (Marks And Spencer), Regulatory Reporting (Emphasized As Best Practice).
Customer Advisories: Transparency about breach impact and remediation steps (Marks and Spencer)
Incident : Cyber Attack MAR0102201110625
Stakeholder Advisories: Investors Notified Via Half-Year Results, Likely Internal Briefings On Recovery Strategies.
Customer Advisories: Indirect (via marketing campaigns and product promotions)
Incident : Data Breach MAR2433524112725
Stakeholder Advisories: Retailers urged to verify resilience; consumers warned about fraud risks.
Customer Advisories: NCSC and experts advise verifying delivery messages and avoiding suspicious e-commerce sites.
Incident : data breach MAR28102028112725
Stakeholder Advisories: Customer Notifications, Faq Page For Affected Customers.
Customer Advisories: password reset promptswarnings about phishing/social engineering risksguidance on online safety
Incident : Cyberattack MAR19103519112725
Stakeholder Advisories: Investors: Notified via London Stock Exchange filing (profit impact disclosure).
Customer Advisories: Data Compromise Warning: Issued (potential risk acknowledged).
What advisories does the company provide to stakeholders and customers following an incident ?
Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Reset passwords, NCSC is providing advice to the retail sector and wider economy, Customers advised to reset passwords on next login; no further action required, Businesses urged to adopt proactive cybersecurity measures to mitigate risks from evolving threats (AI, nation-states, CaaS)., Customers advised to monitor communications from affected retailers for potential data breach notifications or protective measures., NCSC urged retailers to tighten cybersecurity; no specific advisories from M&S/Harrods, M&S warned of service disruptions; Harrods assured normal operations, Ncsc Warns Retailers To Bolster Defenses; No Specific Stakeholder Advisories Detailed, Harrods: No Action Required Per Statement; M&S/Co-Op: No Public Customer Advisories, , Rics Urges Businesses To Address Digital Risks In Building Operations To Avoid 'Sleepwalking' Into Attacks., Marks & Spencer Likely Issued Advisories During The 7-Week Website Outage (Details Unspecified)., , Security Teams Urged To Be 'Ultra Vigilant.', Ncsc Warns Attacks Should Serve As A 'Wake-Up Call' For All Organizations., Experts Recommend Presuming Targeting Is Inevitable And Preparing Accordingly., Update Passwords And Monitor Financial Activity For Signs Of Fraud., Watch For Scams Exploiting Recent Breaches., , Market Updates (M&S £300M Loss), Apologies And Service Updates (H&M, M&S, Co-Op), Data Breach Notifications (Adidas, Co-Op), , Public Statements Confirming Operational Status (Co-Op), No Specific Advisories Mentioned (M&S), , Advice To Businesses: Prepare To Operate On Pen-And-Paper (M&S) Or Segregated Backup Systems (Co-Op)., M&S Updates To Investors And Mps, Tcs Communications To Clients And Media, M&S Notifications About Service Disruptions, Apologies For Order Delays And Stock Shortages, , Ceo-Led Digital Communications (Marks And Spencer), Regulatory Reporting (Emphasized As Best Practice), Transparency About Breach Impact And Remediation Steps (Marks And Spencer), , Investors Notified Via Half-Year Results, Likely Internal Briefings On Recovery Strategies, Indirect (Via Marketing Campaigns And Product Promotions), , Retailers urged to verify resilience; consumers warned about fraud risks., NCSC and experts advise verifying delivery messages and avoiding suspicious e-commerce sites., Customer Notifications, Faq Page For Affected Customers, Password Reset Prompts, Warnings About Phishing/Social Engineering Risks, Guidance On Online Safety, , investors: Notified via London Stock Exchange filing (profit impact disclosure), , data_compromise_warning: Issued (potential risk acknowledged) and .
Initial Access Broker
How did the initial access broker gain entry for each incident ?
Incident : Ransomware MAR1041050625
High Value Targets: Vmware Esxi Hosts,
Data Sold on Dark Web: Vmware Esxi Hosts,
Incident : Cyberattack MAR900062025
Entry Point: Third-party supplier
Incident : Ransomware MAR558070925
Entry Point: Social Engineering
Incident : Ransomware MAR601070925
Entry Point: Compromised credentials from TCS
Incident : Ransomware MAR847071225
Entry Point: Help desk
Incident : Ransomware, Data Theft MAR903072925
Entry Point: Phone-based social engineering
High Value Targets: Vsphere Administrators, Powerful Active Directory Groups,
Data Sold on Dark Web: Vsphere Administrators, Powerful Active Directory Groups,
Incident : Cyber Attack MAR628082925
High Value Targets: Retail Systems, Luxury Brand Databases, Supply Chain Partners,
Data Sold on Dark Web: Retail Systems, Luxury Brand Databases, Supply Chain Partners,
Incident : Ransomware MAR824090225
Entry Point: Phishing, Sim Swapping, Mfa Fatigue,
High Value Targets: Payment Systems, Warehouse Logistics, Job Application Portal,
Data Sold on Dark Web: Payment Systems, Warehouse Logistics, Job Application Portal,
Incident : Unauthorized Access Attempt MAR843090225
High Value Targets: Potential Sap Systems (Shared By M&S And Co-Op),
Data Sold on Dark Web: Potential Sap Systems (Shared By M&S And Co-Op),
Incident : Cyber-Attack MAR844090225
High Value Targets: Building Management Systems, E-Commerce Platforms (E.G., Marks & Spencer Website),
Data Sold on Dark Web: Building Management Systems, E-Commerce Platforms (E.G., Marks & Spencer Website),
Incident : Cyberattack MAR855090225
High Value Targets: Customer Data, Operational Systems,
Data Sold on Dark Web: Customer Data, Operational Systems,
Incident : Ransomware (M&S) MAR5392253090725
Entry Point: Third-Party Vendor (Adidas), Potential Physical Access (Unguarded Sockets/Iot For Others),
High Value Targets: Customer Databases (M&S, Adidas, Co-Op), Payment Systems (H&M, M&S),
Data Sold on Dark Web: Customer Databases (M&S, Adidas, Co-Op), Payment Systems (H&M, M&S),
Incident : Unauthorized Access Attempt MAR1662016090825
Entry Point: It Help Desks (Via Social Engineering),
High Value Targets: M&S Servers (Encrypted),
Data Sold on Dark Web: M&S Servers (Encrypted),
Incident : ransomware MAR0762307092425
High Value Targets: Critical Employee Files, Internal Systems,
Data Sold on Dark Web: Critical Employee Files, Internal Systems,
Incident : ransomware MAR2902029102225
Entry Point: Third-Party Contractor, Impersonation,
High Value Targets: Online Clothing Distribution Center (Castle Donington),
Data Sold on Dark Web: Online Clothing Distribution Center (Castle Donington),
Incident : Data Breach MAR1993619102425
Entry Point: Third-Party Vendors (Compromised Credentials), Unmonitored Endpoints, Api Exploitation,
Reconnaissance Period: Days to weeks (undetected dwell time)
High Value Targets: Customer Databases, Payment Systems, Brand Reputation,
Data Sold on Dark Web: Customer Databases, Payment Systems, Brand Reputation,
Incident : Cyberattack MAR3792037102625
Entry Point: TCS help-desk staff credentials (impersonation/social engineering)
High Value Targets: M&S Online Shopping Platform, Supply Chain Systems, Inventory Management,
Data Sold on Dark Web: M&S Online Shopping Platform, Supply Chain Systems, Inventory Management,
Incident : Cyber Attack MAR5032050110325
Entry Point: Phishing Emails, Deepfake Impersonation (Hong Kong Case),
High Value Targets: Financial Systems (E.G., Cfo Impersonation), Customer Data, Critical Applications,
Data Sold on Dark Web: Financial Systems (E.G., Cfo Impersonation), Customer Data, Critical Applications,
Incident : ransomware MAR1193411110425
High Value Targets: Enterprise Environments, Retailers (E.G., Marks & Spencer), Rival Ransomware Groups (E.G., Blacklock, Ransomhub),
Data Sold on Dark Web: Enterprise Environments, Retailers (E.G., Marks & Spencer), Rival Ransomware Groups (E.G., Blacklock, Ransomhub),
Incident : Cyber Attack MAR0102201110625
High Value Targets: Inventory Systems, E-Commerce Platform,
Data Sold on Dark Web: Inventory Systems, E-Commerce Platform,
Incident : Data Breach MAR2433524112725
High Value Targets: Customer databases (per Scattered Lapsus$ Hunters warning)
Data Sold on Dark Web: Customer databases (per Scattered Lapsus$ Hunters warning)
Incident : data breach MAR28102028112725
High Value Targets: Customer Databases, Online Purchase Systems,
Data Sold on Dark Web: Customer Databases, Online Purchase Systems,
Incident : Cyberattack MAR19103519112725
High Value Targets: Customer Data (Claimed), Supply Chain Systems,
Data Sold on Dark Web: Customer Data (Claimed), Supply Chain Systems,
Post-Incident Analysis
What were the root causes and corrective actions taken for each incident ?
Incident : Ransomware MAR1041050625
Corrective Actions: Accelerated Cybersecurity Investment, Deployed Next-Generation Endpoint Protection And Multi-Factor Authentication Across Cloud And On-Premises Infrastructure,
Incident : Ransomware MAR558070925
Root Causes: Social Engineering, Password Reset Mechanism,
Incident : Ransomware MAR601070925
Root Causes: Compromised credentials and lack of system segmentation
Corrective Actions: Rebuilding systems and improving segmentation
Incident : Ransomware MAR847071225
Root Causes: Employee impersonation and unauthorized system access
Corrective Actions: Improve employee training and foster a culture of transparent communication
Incident : Ransomware, Data Theft MAR903072925
Root Causes: Weak identity verification procedures in IT help desks
Incident : Cyber Attack MAR628082925
Root Causes: Underinvestment In Proactive Cybersecurity Measures, Over-Reliance On In-House Teams Without External Expertise, Failure To Adapt To Evolving Threats (Ai, Caas, Nation-State Actors), Lack Of Comprehensive Cyber Insurance And Resilience Planning,
Corrective Actions: Increase Cybersecurity Budgets (77% Of Uk Businesses Planning To Do So)., Implement Xdr, Mfa, And Vulnerability Scanning To Reduce Insurance Premiums., Adopt Outsourced Cybersecurity Solutions For Specialized Expertise., Comply With Upcoming Regulations (E.G., Cyber Security And Resilience Bill 2025)., Position Cybersecurity As A Strategic Revenue Driver, Not Just A Protective Measure.,
Incident : Ransomware MAR824090225
Root Causes: Phishing Vulnerabilities, Mfa Fatigue Exploits, Lack Of Segmentation (Warehouse/Retail Systems Impacted),
Incident : Cyber-Attack MAR844090225
Root Causes: Use Of Outdated, Unsupported Software (E.G., Windows 7) In Building Systems., Inadequate Security For Operational Technology (Ot) And Iot Devices., Lack Of Preparedness For Cyber-Physical Attacks On Smart Infrastructure., Underestimation Of Risks Associated With Interconnected Building Technologies.,
Corrective Actions: Mandate Regular Audits Of Ot/It Systems In Commercial Buildings., Invest In Modernizing Legacy Systems In Smart Buildings., Integrate Cybersecurity Into Facilities Management Training., Collaborate With Cybersecurity Firms To Assess Building-Specific Risks.,
Incident : Cyberattack MAR855090225
Root Causes: Potential Exploitation Of Human Vulnerabilities (E.G., Social Engineering)., Lack Of Robust Endpoint Protection Or Detection Tools In Some Cases., High-Value Target Sector (Retail) With Critical Operational Dependencies.,
Corrective Actions: Enhance Endpoint Protection And Detection Capabilities., Implement Mfa And Staff Training Programs., Develop And Test Incident Response Plans Regularly., Segment Networks To Limit Lateral Movement By Attackers.,
Incident : Ransomware (M&S) MAR5392253090725
Root Causes: Third-Party Vendor Vulnerabilities (Adidas), Insecure Iot/Building Systems (Theoretical For Co-Op/H&M), Raas Proliferation (Dragonforce For M&S), Lack Of Payment System Redundancy (H&M, M&S),
Corrective Actions: Vendor Security Audits (Adidas), It System Segmentation (Co-Op, Harrods), Offline Payment Fallback (H&M, M&S),
Incident : Unauthorized Access Attempt MAR1662016090825
Root Causes: Social Engineering (Mfa Bombing, Sim Swapping, Phishing),
Incident : ransomware MAR0762307092425
Root Causes: Lack Of Isolated/Offline Backups Allowing Ransomware To Encrypt Critical Files., Potential Exploitation Of Network-Connected Backup Vulnerabilities (Historical Context).,
Incident : ransomware MAR2902029102225
Root Causes: Sophisticated Impersonation And Third-Party Compromise, Determined Threat Actor Exploiting Complex Organizational Structure, Potential Delays In Detection (Attack Began 17 April, Detected 19 April),
Corrective Actions: Ongoing System Rebuild, Collaboration With Law Enforcement (Fbi, Nca, Met Police), Review Of Third-Party Access Controls, Potential Advocacy For Mandatory Attack Reporting (Ncsc),
Incident : Data Breach MAR1993619102425
Root Causes: Lack Of Centralized Visibility Into Digital Environments (Logs, Telemetry, User Activity)., Weak Identity/Access Controls (Stolen Credentials, Unmonitored Endpoints)., Siloed Logging And Delayed Threat Detection., Insufficient Network Segmentation Enabling Lateral Movement., Unpatched Vulnerabilities And Poor Api Security., Inadequate Security Culture/Training (Phishing, Social Engineering Risks).,
Corrective Actions: Deploy Unified Log Management And Real-Time Threat Detection Platforms., Enforce Zero Trust Architecture With Strict Access Controls And Mfa., Segment Networks To Limit Breach Impact And Lateral Movement., Enhance Api/Application Monitoring For Behavioral Anomalies., Automate Vulnerability Scanning And Prioritize High-Risk Patching., Integrate Security Awareness Into Organizational Culture Via Regular Training., Test Incident Response Plans With Simulations And Ensure Immutable Backups., Improve Post-Incident Communication Transparency To Retain Customer Trust.,
Incident : Cyberattack MAR3792037102625
Root Causes: Over-Reliance On Third-Party Vendor (Tcs) For Critical Help-Desk Access Without Sufficient Safeguards., Lack Of Robust Authentication (E.G., Mfa) For Vendor Logins, Enabling Credential Theft Via Impersonation., Inadequate Segmentation Between M&S Systems And Tcs Help-Desk Access, Allowing Lateral Movement., Social Engineering Vulnerabilities In Help-Desk Processes (E.G., Scripted Password Resets)., Complex Outsourcing Ecosystem With Elevated Third-Party Access, Increasing Attack Surface.,
Corrective Actions: Termination Of Tcs Help-Desk Contract (Though M&S Claims Unrelated To Breach)., Likely Review Of All Third-Party Access Controls And Authentication Mechanisms., Potential Adoption Of Zero-Trust Architecture For Vendor Access., Enhanced Monitoring Of Help-Desk Activities For Anomalous Behavior., Reevaluation Of Outsourcing Strategies To Balance Cost Savings With Cyber Risk.,
Incident : Cyber Attack MAR5032050110325
Root Causes: Human Error (E.G., Falling For Deepfake/Phishing), Inadequate Training, Lack Of Proactive Threat Detection,
Corrective Actions: Enhanced Employee Training On Emerging Threats., Implementation Of Third-Party Backup Solutions., Board-Level Cybersecurity Accountability., Adoption Of Early Detection Technologies.,
Incident : ransomware MAR1193411110425
Root Causes: Exploitation Of Conti’S Leaked Source Code For New Ransomware Development., Leveraging Affiliate Networks To Scale Attacks (E.G., Devman, Scattered Spider)., Use Of Smb For Lateral Movement And Network-Wide Encryption., Cartel-Like Coordination To Dominate The Ransomware Ecosystem.,
Incident : Cyber Attack MAR0102201110625
Root Causes: Inadequate Cybersecurity Measures To Prevent Disruption During Peak Periods., Vulnerabilities In Supply Chain And Stock Management Systems., Lack Of Redundancy In Transactional Website Infrastructure.,
Corrective Actions: £100M+ Investment In Cybersecurity And Technology Upgrades., Supply Chain Modernization Program., Store Updates To Improve Operational Resilience., Enhanced Marketing To Rebuild Customer Base.,
Incident : Data Breach MAR2433524112725
Root Causes: Opportunistic Exploitation Of Vulnerabilities (Misconfigurations, Brute Force)., Distraction During Peak Sales Periods Diverting Attention From Cybersecurity., Lack Of Continuous Monitoring Leading To Undetected Drift In Defenses.,
Corrective Actions: Implement Continuous Assurance Frameworks., Enhance Monitoring During Holidays/Weekends (High-Risk Periods For Ransomware)., Strengthen Consumer Education On Fraud Prevention.,
Incident : Cyberattack MAR19103519112725
Corrective Actions: Planned: ['Infrastructure upgrades', 'Network connectivity improvements', 'Supply chain system enhancements'],
What is the company's process for conducting post-incident analysis ?
Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Faster ransomware detection capabilities, Tata Consultancy Services, , Professional intermediaries, Strong Identity Verification, Vmware Hardening, Backup Integrity, Continuous Monitoring, , Organizations Involved: ['UK National Cyber Security Centre (NCSC)'], , , Ncsc (Assisting M&S And Co-Op), National Crime Agency (Nca) And Metropolitan Police Cybercrime Unit (M&S Investigation), , Security Teams Advised To Deploy Endpoint Protection Software, , Likely (M&S, Co-Op For Forensic Investigation), , National Cyber Security Centre (Ncsc), National Crime Agency (Nca), Metropolitan Police Cyber Crime Unit, , National Cyber Security Centre (Ncsc), Fbi, National Crime Agency, Metropolitan Police, Ransomware Specialists (Unspecified), , Invested Hundreds Of Millions In Cybersecurity Pre-Attack, Expanded Prevention Team To 80 Staff, , , Likely (though not explicitly stated), Cloud Backup Providers (E.G., Amazon, Google, Microsoft), Specialist Third-Party Backup Services, Incident Response Retainers, , Early Detection Technologies For Threat Identification, , Recommended For Unusual Access To Shared Resources, , Planned (part of cybersecurity investment), Recommended (continuous assurance for drift detection), U.K. National Cyber Security Centre (Ncsc), .
What corrective actions has the company taken based on post-incident analysis ?
Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Accelerated Cybersecurity Investment, Deployed Next-Generation Endpoint Protection And Multi-Factor Authentication Across Cloud And On-Premises Infrastructure, , Rebuilding systems and improving segmentation, Improve employee training and foster a culture of transparent communication, Increase Cybersecurity Budgets (77% Of Uk Businesses Planning To Do So)., Implement Xdr, Mfa, And Vulnerability Scanning To Reduce Insurance Premiums., Adopt Outsourced Cybersecurity Solutions For Specialized Expertise., Comply With Upcoming Regulations (E.G., Cyber Security And Resilience Bill 2025)., Position Cybersecurity As A Strategic Revenue Driver, Not Just A Protective Measure., , Mandate Regular Audits Of Ot/It Systems In Commercial Buildings., Invest In Modernizing Legacy Systems In Smart Buildings., Integrate Cybersecurity Into Facilities Management Training., Collaborate With Cybersecurity Firms To Assess Building-Specific Risks., , Enhance Endpoint Protection And Detection Capabilities., Implement Mfa And Staff Training Programs., Develop And Test Incident Response Plans Regularly., Segment Networks To Limit Lateral Movement By Attackers., , Vendor Security Audits (Adidas), It System Segmentation (Co-Op, Harrods), Offline Payment Fallback (H&M, M&S), , Ongoing System Rebuild, Collaboration With Law Enforcement (Fbi, Nca, Met Police), Review Of Third-Party Access Controls, Potential Advocacy For Mandatory Attack Reporting (Ncsc), , Deploy Unified Log Management And Real-Time Threat Detection Platforms., Enforce Zero Trust Architecture With Strict Access Controls And Mfa., Segment Networks To Limit Breach Impact And Lateral Movement., Enhance Api/Application Monitoring For Behavioral Anomalies., Automate Vulnerability Scanning And Prioritize High-Risk Patching., Integrate Security Awareness Into Organizational Culture Via Regular Training., Test Incident Response Plans With Simulations And Ensure Immutable Backups., Improve Post-Incident Communication Transparency To Retain Customer Trust., , Termination Of Tcs Help-Desk Contract (Though M&S Claims Unrelated To Breach)., Likely Review Of All Third-Party Access Controls And Authentication Mechanisms., Potential Adoption Of Zero-Trust Architecture For Vendor Access., Enhanced Monitoring Of Help-Desk Activities For Anomalous Behavior., Reevaluation Of Outsourcing Strategies To Balance Cost Savings With Cyber Risk., , Enhanced Employee Training On Emerging Threats., Implementation Of Third-Party Backup Solutions., Board-Level Cybersecurity Accountability., Adoption Of Early Detection Technologies., , £100M+ Investment In Cybersecurity And Technology Upgrades., Supply Chain Modernization Program., Store Updates To Improve Operational Resilience., Enhanced Marketing To Rebuild Customer Base., , Implement Continuous Assurance Frameworks., Enhance Monitoring During Holidays/Weekends (High-Risk Periods For Ransomware)., Strengthen Consumer Education On Fraud Prevention., , planned: ['Infrastructure upgrades', 'Network connectivity improvements', 'Supply chain system enhancements'], .
Additional Questions
General Information
Has the company ever paid ransoms ?
Ransom Payment History: The company has Paid ransoms in the past.
What was the amount of the last ransom demanded ?
Last Ransom Demanded: The amount of the last ransom demanded was Yes.
Who was the attacking group in the last incident ?
Last Attacking Group: The attacking group in the last incident were an DragonForce group, Scattered Spider, Scattered Spider, DragonForce hacking collective, DragonForce, Scattered Spider (DragonForce), DragonForce ransomware group, Scattered Spider, Cybercriminal groupsMany based in Russia, Scattered Spider (0ktapus, UNC3944), Claimed By: DragonForce ransomware group, ScatteredSpiderHostile nation-statesCybercriminal groups, Scattered Spider (Octo Tempest), Scattered Spider (linked to M&S attack)Unidentified actors for Harrods and Co-op, ScatteredSpider (alleged for M&S), DragonForce (suspected for M&S and possibly others), Scattered Spider (alleged for M&S), DragonForce (ransomware group)Scattered Spider (hacking collective), Scattered Spider, Scattered SpiderUnidentified Fraudsters (Hong Kong Deepfake Case), DragonForceDevman (affiliate)Scattered Spider (partner), Scattered Lapsus$ Hunters (alleged upcoming attacks under #ShinyHuntazz)Unspecified ransomware groups (e.g., M&S and Co-Op Group breaches)Fraudsters operating fake e-commerce sites, Scattered SpiderDragonForce and DragonForce (ransomware group).
Incident Details
What was the most recent incident detected ?
Most Recent Incident Detected: The most recent incident detected was on April 2023.
What was the most recent incident publicly disclosed ?
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2024-04-03T00:00:00Z.
What was the most recent incident resolved ?
Most Recent Incident Resolved: The most recent incident resolved was on ['2024-06-XX (M&S, partial recovery ongoing)', None, None, None, '2024-06-XX (H&M, within 2 hours for most stores)'].
Impact of the Incidents
What was the highest financial loss from an incident ?
Highest Financial Loss: The highest financial loss from an incident was {'operating_profit_impact': '£300 million (before cost mitigation, insurance, and trading actions)', 'insurance_claim': 'Up to £100 million (maximum policy claim)', 'first_quarter_costs': ['Additional waste', 'Logistics costs (manual processes)', 'Reduced availability'], 'second_quarter_costs': ['Increased stock management', 'Online disruption (June–July)'], 'revenue_loss': None, 'conversion_rate_impact': None}.
What was the most significant data compromised in an incident ?
Most Significant Data Compromised: The most significant data compromised in an incident were Personally Identifiable Information (PII), , Personal Data, Customer data, , Customer data, Home addresses, Phone numbers, Dates of birth, , Names, Birth Dates, Addresses, Phone Numbers, Household Information, Order Histories, , Sensitive data, Active Directory database, , Names, Home addresses, Email addresses, Phone numbers, , Unconfirmed for Harrods; M&S and Co-op: potential internal system data (no confirmation of customer data breach), , Customer names/contact details (Adidas, Co-op), Customer information (M&S, no payment details/passwords), None confirmed (Harrods, H&M), , , , basic contact details, dates of birth, online order histories, masked payment information, customer reference numbers (M&S credit card/Sparks Pay holders), Status: Potentially compromised (claimed by DragonForce, not yet leaked), , Status: Potentially compromised (claimed by DragonForce, not yet leaked) and .
What was the most significant system affected in an incident ?
Most Significant System Affected: The most significant system affected in an incident were VMware ESXi hostse-commerce platformspayment platforms and Online shopping ordersClick and collectContactless payments and Online SalesContactless Payments and Online services and and and Virtual machinesContactless paymentsClick-and-collectOnline ordering and Local councilsSchoolsNHSBritish LibraryMarks & SpencerCo-opHarrods and VMware vSphere environmentsESXi hostsVCSA and Online shopping platformInventory managementProduct availability systems and Online order processingContactless paymentsClick-and-collect servicesWarehouse logistics (Castle Donington)Gift card/return processingJob application portal and Harrods: restricted internet access at sites, some systems shut downM&S: online orders halted (~1 week), automated stock systems, loyalty scheme, gift card payments, recruitment systems (job postings paused)Co-op: internal systems shut down, online conferencing security warnings and Website Ordering System (Marks & Spencer)Building Management SystemsCCTV NetworksIoT DevicesAccess Control SystemsHVAC/Lighting Systems and Store SystemsOnline PlatformsIT Infrastructure and Ecommerce, contactless payments (M&S)Internal IT systems, internet access (Harrods)Payments systems (H&M, in-store)IT systems (Co-op, leading to empty shelves)Third-party customer service (Adidas) and Back-office systems (Co-op)Call centers (Co-op)Servers (M&S, encrypted)Online ordering systems (M&S)App-based ordering (M&S) and internal systemscritical employee files and online store (closed for ~7 weeks)online clothing distribution center (Castle Donington, Leicestershire) and and Online Shopping PlatformClick-and-Collect OperationsSupply Chain SystemsInventory ManagementStore Stocking Systems and local storagenetwork shares via SMB and Inventory ManagementE-commerce PlatformTransactional WebsiteSupply Chain and and online purchase systemsstore inventory systems and App (unavailable)Online shopping platform (paused)Supply chain systemsStore stocking processesManual logistics operations.
Response to the Incidents
What third-party assistance was involved in the most recent incident ?
Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was tata consultancy services, , Professional intermediaries, Organizations Involved: ['UK National Cyber Security Centre (NCSC)'], , ncsc (assisting m&s and co-op), national crime agency (nca) and metropolitan police cybercrime unit (m&s investigation), , likely (m&s, co-op for forensic investigation), , national cyber security centre (ncsc), national crime agency (nca), metropolitan police cyber crime unit, , national cyber security centre (ncsc), fbi, national crime agency, metropolitan police, ransomware specialists (unspecified), , cloud backup providers (e.g., amazon, google, microsoft), specialist third-party backup services, incident response retainers, , u.k. national cyber security centre (ncsc), .
What containment measures were taken in the most recent incident ?
Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Disabled online shopping ordersDisabled click and collectDisabled contactless payments in some stores, Shut down systems to prevent further spread, Shutting down systems, Online orders suspendedJob listings removedAffected systems isolated, Harrods: restricted internet access, shut down some systemsM&S: halted online orders, paused hiring/recruitment systemsCo-op: shut down internal systems, staff warnings for online conferencing, Restricted internet access (Harrods)IT systems taken down (Co-Op), Restricted internal IT systems, paused internet access (Harrods)Shut down parts of IT systems (Co-op)Suspended online orders (M&S), Shut down back-office/call center systems (Co-op)Offline systems (M&S), isolation of affected systemsshutdown of online storereliance on pen-and-paper processes, Network Segmentation (Recommended)Isolation of Affected Systems (Recommended), Suspension of online ordersPartial halt of click-and-collect servicesIsolation of compromised systems (presumed), Restoration of shops and websites to normal operations and Pausing online shoppingManual logistics processes.
Data Breach Information
What was the most sensitive data compromised in a breach ?
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Phone numbers, Customer information (M&S, no payment details/passwords), None confirmed (Harrods, H&M), Customer names/contact details (Adidas, Co-op), masked payment information, online order histories, Home addresses, Birth Dates, Order Histories, Customer data, Personal Data, Active Directory database, Email addresses, customer reference numbers (M&S credit card/Sparks Pay holders), dates of birth, Dates of birth, Personally Identifiable Information (PII), Household Information, Names, Phone Numbers, Addresses, Unconfirmed for Harrods; M&S and Co-op: potential internal system data (no confirmation of customer data breach), basic contact details and Sensitive data.
What was the number of records exposed in the most significant breach ?
Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 6.5M.
Ransomware Information
What was the highest ransom paid in a ransomware incident ?
Highest Ransom Paid: The highest ransom paid in a ransomware incident was ["M&S: no confirmation (stated 'not discussing details')", 'unnamed UK company: paid (per MP David Davis)'].
Regulatory Compliance
What was the most significant legal action taken for a regulatory violation ?
Most Significant Legal Action: The most significant legal action taken for a regulatory violation was U.S. prosecutors charged 5 alleged Scattered Spider members (November 2023), .
Lessons Learned and Recommendations
What was the most significant lesson learned from past incidents ?
Most Significant Lesson Learned: The most significant lesson learned from past incidents was Consumer-targeted fraud (e.g., fake sites, phishing) spikes during holidays, requiring heightened vigilance.
What was the most significant recommendation implemented to improve cybersecurity ?
Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Implement multi-layered defenses: MFA, adaptive behavioral WAFs, network segmentation, and enhanced monitoring., Invest in employee training programs that address emerging threats (e.g., deepfakes, social engineering)., Enhance third-party risk management (given impersonation via contractor)., Implement multi-layered backup strategies to avoid single points of failure., customers advised to reset passwords, Leverage data analytics to predict and mitigate stock availability risks., Conduct thorough post-incident root cause analyses to harden systems and share lessons industry-wide., Invest in detection systems for faster response (e.g., Co-op's hours-long detection)., Multi-Factor Authentication (MFA) hardening recommended, Monitor financial activity and update passwords (for consumers)., Monitor dark web and underground forums for signs of compromised vendor credentials or targeted attacks., Replace end-of-life operating systems (e.g., Windows 7) with supported, patched versions., Develop a communication strategy that prioritizes openness and honesty within 48 hours of an incident., Deploy endpoint protection and detection tools (e.g., EDR)., Conduct regular simulations of cyber incidents to test response plans and recovery timelines., Adopt zero-trust principles for vendor access, minimizing standing privileges and enforcing least-privilege access., NCSC guidance for mitigating future ransomware attacks, Elevate cybersecurity to a board-level imperative with designated expertise (e.g., Virtual CISO)., Conduct regular vulnerability assessments for interconnected building systems., Conduct user awareness training to prevent initial access exploits., Develop incident response plans tailored to operational technology disruptions., Educate consumers on recognizing fake e-commerce sites and phishing scams (e.g., typosquatting, fake trust badges)., Implement zero-trust architecture for third-party access., Double-check resilience during peak sales periods (e.g., Black Friday, Christmas)., Develop playbooks for ransomware attacks, including offline payment contingencies., Implement network segmentation and Zero Trust principles to limit breach impact., Evaluate offline/air-gapped backup solutions (e.g., data diodes) for critical data, weighing costs against risk reduction., Develop segregated backup systems for critical processes (Co-op's 'break glass' approach)., NCSC urges organizations to implement preventive measures and robust incident response/recovery plans, Retailers urged to enhance cybersecurity (NCSC advisory), Enhance monitoring of building management systems, CCTV, and IoT devices., Regularly test backup integrity and recovery procedures to ensure effectiveness against ransomware., Train staff to recognize phishing and social engineering attacks., Review outsourcing contracts to include cybersecurity SLAs, liability clauses, and breach response obligations., Mandate reporting of major cyber-attacks to NCSC (per Archie Norman)., Evaluate cyber insurance coverage (Co-op chose detection over insurance; M&S relying on >£100m claim)., Greater transparency and cyberattack reporting, Adopt a visibility-first security posture with centralized log management and SIEM capabilities., Automate vulnerability scanning and prioritize patching based on risk/exploitability., Outsource cybersecurity to leverage external expertise, especially for SMEs lacking in-house capabilities., Invest in advanced security measures such as XDR platforms, multi-factor authentication (MFA), and vulnerability scanning., Implement multi-factor authentication (MFA) for administrative access., Implement multi-layered cybersecurity defenses, including real-time threat detection., Accelerate digital transformation to improve operational agility., Prioritize detection/response for high-impact threats (ransomware, phishing, misconfigurations)., Develop and rehearse incident response plans with clear communication protocols., Develop a crisis communication plan to retain customer trust during disruptions., View cybersecurity as a revenue driver, not just a cost center, to gain competitive advantage and customer trust., Enhance employee training on physical security (e.g., unguarded network sockets)., Defend against affiliate-based attacks by tracking emerging ransomware strains., Establish incident response retainers for immediate access to expert assistance during breaches., Raise awareness among facilities managers about cyber risks in digital environments., Implement stricter authentication for third-party vendor access (e.g., MFA, behavioral biometrics)., Assume breaches will occur and prepare for rapid response and recovery., Invest in regular, scenario-based security training for employees to reduce human error., Organisations must protect their virtualised assets through strong identity verification, VMware hardening, backup integrity, and continuous monitoring., Maintain separate third-party backups of cloud data to ensure rapid recovery of critical applications., Implement robust backup practices to mitigate encryption impacts., vigilance against phishing/social engineering attacks, Shift from reactive to proactive cybersecurity strategies to mitigate financial and operational risks., Deploy next-generation endpoint protection, Conduct regular red-team exercises simulating supply-chain and RaaS attacks., Enhance training for help-desk staff to detect and resist social engineering attacks (e.g., impersonation, phishing)., Integrate vendor risk management into enterprise cybersecurity frameworks, treating critical suppliers as extensions of internal systems., Assess physical security measures for offline storage to mitigate theft risks., Consider distributing encrypted backup units across secure locations to reduce risk concentration., Ensure transparent, timely communication with stakeholders, regulators, and customers during breaches., Prioritize cyber insurance to comply with upcoming regulations (e.g., Cyber Security and Resilience Bill 2025) and reduce premiums through risk mitigation., Audit and segment IoT/building management systems from critical networks., Consumers advised to monitor bank activity and update passwords, Verify delivery notifications directly with carriers to avoid falling for fake tracking messages., Develop and test incident response plans with tabletop exercises and immutable backups., Enforce least-privilege access, MFA, and continuous monitoring for identity and access controls., Strengthen partnerships (e.g., Ocado) to diversify revenue streams., Implement multi-factor authentication, Conduct regular audits of vendor cybersecurity practices, especially for help-desk and privileged access roles., Apply consistent patching and endpoint protection., Conduct regular stress tests for e-commerce and supply chain systems., Educate stakeholders on the financial and operational benefits of early cybersecurity investment., Treat cybersecurity as a board-level priority tied to business continuity, not just an IT issue., Monitor API traffic and application behavior in real time for early threat detection., Restrict lateral movement via network segmentation., Develop incident response playbooks specifically for third-party breaches, including clear communication protocols., Adopt continuous assurance to monitor defense posture and prevent vulnerabilities., Implement network segmentation for OT and IT systems in smart buildings., Retailers using SAP systems advised to review security postures, Implement training and attack simulation training to help employees recognize and respond to cyber threats appropriately., Monitor for unusual access to shared resources (e.g. and SMB)..
References
What is the most recent source of information about an incident ?
Most Recent Source: The most recent source of information about an incident are ESET (Jake Moore, Global Cybersecurity Advisor), Royal Institution of Chartered Surveyors (RICS), Thomas Richards, Infrastructure Security Practice Director at Black Duck, Reuters, The Guardian (Secureworks interview), Media reports on M&S cyberattack and TCS contract termination, BleepingComputer or similar cybersecurity news outlet (implied), Marks & Spencer, Darktrace (Nathaniel Jones, VP of Security & AI Strategy), Semperis Report on Ransomware Timing, Sky News, U.K. National Cyber Security Centre (NCSC) Statement, The Guardian, Al Jazeera, BleepingComputer, Cohesity Survey, Ex-NSA Cyber Chief - Cody Barrow, TCS public statements on the incident, Reuters / Media Reports on UK Retail Cyberattacks, UK National Cyber Security Centre (NCSC), Action Fraud Data (£11.8m Fraud Loss), SonicWall (Spencer Starkey, Executive VP of EMEA), M&S Public Disclosure, Statements from M&S CEO Stuart Machin to UK Parliament, Marks & Spencer (M&S) Statement to London Stock Exchange, Huntsman Security Analysis (ICO Data Q3 2024–Q2 2025), Dynatrace & FreedomPay Report, Adidas Data Breach Notice (May 2024), UK NCSC (Festive Fraud Trends), NCC Group (Matt Hull, Head of Threat Intelligence), Marks and Spencer Public Statement, TechRadar Pro, ReliaQuest (Scattered Lapsus$ Hunters Telegram Post), National Cyber Security Centre (NCSC) - Dr. Richard Horne, BlackFog Report, UK Parliament Business and Trade Subcommittee on Economic Security, Arms and Export Controls, TechRadar Pro - Expert Insights, Marks and Spencer Trading Update (CEO Stuart Machin), UK Parliament hearing on July 8, Marks & Spencer Half-Year Results H1 2025, Google’s Threat Intelligence Group (GTIG), Security Journal UK (October 2025 Edition), Harrods Statement (1 May 2024), Acronis Threat Research Unit (TRU), CloudSEK (Fake E-commerce Sites Analysis), Duke’s CFO Global Business Outlook, Blocksandfiles (interview with Matt Peterman and Nino Eškić) and Royal Institution of Chartered Surveyors (Rics) Report.
What is the most recent URL for additional resources on cybersecurity best practices ?
Most Recent URL for Additional Resources: The most recent URL for additional resources on cybersecurity best practices is https://www.ncsc.gov.uk, https://www.techradar.com, https://www.theguardian.com/business/2024/may/02/harrods-hit-by-cyber-attack-days-after-marks-spencer-and-co-op, https://www.theguardian.com/business/2024/jun/10/uk-businesses-cyber-attack-risk-smart-buildings-rics, https://www.theguardian.com/technology/2024/may/XX/rics-cyber-attacks-smart-buildings, https://www.theguardian.com/business/2024/jun/11/marks-spencer-cyber-attack-online-store-archie-norman, https://www.securityjournaluk.com, https://www.techradar.com/pro .
Investigation Status
What is the current status of the most recent investigation ?
Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing.
Stakeholder and Customer Advisories
What was the most recent stakeholder advisory issued ?
Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was NCSC is providing advice to the retail sector and wider economy, Businesses urged to adopt proactive cybersecurity measures to mitigate risks from evolving threats (AI, nation-states, CaaS)., NCSC urged retailers to tighten cybersecurity; no specific advisories from M&S/Harrods, NCSC warns retailers to bolster defenses; no specific stakeholder advisories detailed, Rics urges businesses to address digital risks in building operations to avoid 'sleepwalking' into attacks., Security teams urged to be 'ultra vigilant.', NCSC warns attacks should serve as a 'wake-up call' for all organizations., Experts recommend presuming targeting is inevitable and preparing accordingly., Market updates (M&S £300m loss), Advice to businesses: prepare to operate on pen-and-paper (M&S) or segregated backup systems (Co-op)., M&S updates to investors and MPs, TCS communications to clients and media, CEO-led digital communications (Marks and Spencer), Regulatory reporting (emphasized as best practice), Investors notified via half-year results, Likely internal briefings on recovery strategies, Retailers urged to verify resilience; consumers warned about fraud risks., customer notifications, FAQ page for affected customers, investors: Notified via London Stock Exchange filing (profit impact disclosure), .
What was the most recent customer advisory issued ?
Most Recent Customer Advisory: The most recent customer advisory issued were an Reset passwords, Customers advised to reset passwords on next login; no further action required, Customers advised to monitor communications from affected retailers for potential data breach notifications or protective measures., M&S warned of service disruptions; Harrods assured normal operations, Harrods: no action required per statement; M&S/Co-op: no public customer advisories, Marks & Spencer likely issued advisories during the 7-week website outage (details unspecified)., Update passwords and monitor financial activity for signs of fraud.Watch for scams exploiting recent breaches., Apologies and service updates (H&M, M&S, Co-op)Data breach notifications (Adidas, Co-op), Public statements confirming operational status (Co-op)No specific advisories mentioned (M&S), M&S notifications about service disruptionsApologies for order delays and stock shortages, Transparency about breach impact and remediation steps (Marks and Spencer), Indirect (via marketing campaigns and product promotions), NCSC and experts advise verifying delivery messages and avoiding suspicious e-commerce sites., password reset promptswarnings about phishing/social engineering risksguidance on online safety, data_compromise_warning: Issued (potential risk acknowledged) and .
Initial Access Broker
What was the most recent entry point used by an initial access broker ?
Most Recent Entry Point: The most recent entry point used by an initial access broker were an Phone-based social engineering, Help desk, Compromised credentials from TCS, Third-party supplier, TCS help-desk staff credentials (impersonation/social engineering) and Social Engineering.
What was the most recent reconnaissance period for an incident ?
Most Recent Reconnaissance Period: The most recent reconnaissance period for an incident was Days to weeks (undetected dwell time).
Post-Incident Analysis
What was the most significant root cause identified in post-incident analysis ?
Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Social EngineeringPassword Reset Mechanism, Compromised credentials and lack of system segmentation, Employee impersonation and unauthorized system access, Weak identity verification procedures in IT help desks, Underinvestment in proactive cybersecurity measuresOver-reliance on in-house teams without external expertiseFailure to adapt to evolving threats (AI, CaaS, nation-state actors)Lack of comprehensive cyber insurance and resilience planning, Phishing vulnerabilitiesMFA fatigue exploitsLack of segmentation (warehouse/retail systems impacted), Use of outdated, unsupported software (e.g., Windows 7) in building systems.Inadequate security for operational technology (OT) and IoT devices.Lack of preparedness for cyber-physical attacks on smart infrastructure.Underestimation of risks associated with interconnected building technologies., Potential exploitation of human vulnerabilities (e.g., social engineering).Lack of robust endpoint protection or detection tools in some cases.High-value target sector (retail) with critical operational dependencies., Third-party vendor vulnerabilities (Adidas)Insecure IoT/building systems (theoretical for Co-op/H&M)RaaS proliferation (DragonForce for M&S)Lack of payment system redundancy (H&M, M&S), Social engineering (MFA bombing, SIM swapping, phishing), Lack of isolated/offline backups allowing ransomware to encrypt critical files.Potential exploitation of network-connected backup vulnerabilities (historical context)., Sophisticated impersonation and third-party compromiseDetermined threat actor exploiting complex organizational structurePotential delays in detection (attack began 17 April, detected 19 April), Lack of centralized visibility into digital environments (logs, telemetry, user activity).Weak identity/access controls (stolen credentials, unmonitored endpoints).Siloed logging and delayed threat detection.Insufficient network segmentation enabling lateral movement.Unpatched vulnerabilities and poor API security.Inadequate security culture/training (phishing, social engineering risks)., Over-reliance on third-party vendor (TCS) for critical help-desk access without sufficient safeguards.Lack of robust authentication (e.g., MFA) for vendor logins, enabling credential theft via impersonation.Inadequate segmentation between M&S systems and TCS help-desk access, allowing lateral movement.Social engineering vulnerabilities in help-desk processes (e.g., scripted password resets).Complex outsourcing ecosystem with elevated third-party access, increasing attack surface., Human Error (e.g., falling for deepfake/phishing)Inadequate TrainingLack of Proactive Threat Detection, Exploitation of Conti’s leaked source code for new ransomware development.Leveraging affiliate networks to scale attacks (e.g., Devman, Scattered Spider).Use of SMB for lateral movement and network-wide encryption.Cartel-like coordination to dominate the ransomware ecosystem., Inadequate cybersecurity measures to prevent disruption during peak periods.Vulnerabilities in supply chain and stock management systems.Lack of redundancy in transactional website infrastructure., Opportunistic exploitation of vulnerabilities (misconfigurations, brute force).Distraction during peak sales periods diverting attention from cybersecurity.Lack of continuous monitoring leading to undetected drift in defenses..
What was the most significant corrective action taken based on post-incident analysis ?
Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Accelerated cybersecurity investmentDeployed next-generation endpoint protection and multi-factor authentication across cloud and on-premises infrastructure, Rebuilding systems and improving segmentation, Improve employee training and foster a culture of transparent communication, Increase cybersecurity budgets (77% of UK businesses planning to do so).Implement XDR, MFA, and vulnerability scanning to reduce insurance premiums.Adopt outsourced cybersecurity solutions for specialized expertise.Comply with upcoming regulations (e.g., Cyber Security and Resilience Bill 2025).Position cybersecurity as a strategic revenue driver, not just a protective measure., Mandate regular audits of OT/IT systems in commercial buildings.Invest in modernizing legacy systems in smart buildings.Integrate cybersecurity into facilities management training.Collaborate with cybersecurity firms to assess building-specific risks., Enhance endpoint protection and detection capabilities.Implement MFA and staff training programs.Develop and test incident response plans regularly.Segment networks to limit lateral movement by attackers., Vendor security audits (Adidas)IT system segmentation (Co-op, Harrods)Offline payment fallback (H&M, M&S), Ongoing system rebuildCollaboration with law enforcement (FBI, NCA, Met Police)Review of third-party access controlsPotential advocacy for mandatory attack reporting (NCSC), Deploy unified log management and real-time threat detection platforms.Enforce Zero Trust architecture with strict access controls and MFA.Segment networks to limit breach impact and lateral movement.Enhance API/application monitoring for behavioral anomalies.Automate vulnerability scanning and prioritize high-risk patching.Integrate security awareness into organizational culture via regular training.Test incident response plans with simulations and ensure immutable backups.Improve post-incident communication transparency to retain customer trust., Termination of TCS help-desk contract (though M&S claims unrelated to breach).Likely review of all third-party access controls and authentication mechanisms.Potential adoption of zero-trust architecture for vendor access.Enhanced monitoring of help-desk activities for anomalous behavior.Reevaluation of outsourcing strategies to balance cost savings with cyber risk., Enhanced employee training on emerging threats.Implementation of third-party backup solutions.Board-level cybersecurity accountability.Adoption of early detection technologies., £100m+ investment in cybersecurity and technology upgrades.Supply chain modernization program.Store updates to improve operational resilience.Enhanced marketing to rebuild customer base., Implement continuous assurance frameworks.Enhance monitoring during holidays/weekends (high-risk periods for ransomware).Strengthen consumer education on fraud prevention., planned: ['Infrastructure upgrades', 'Network connectivity improvements', 'Supply chain system enhancements'], .
.png)
Latest Global CVEs (Not Company-Specific)
Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.
Risk Information
cvss4
Base: 7.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
References
- https://github.com/angular/angular/commit/0276479e7d0e280e0f8d26fa567d3b7aa97a516f
- https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc
- https://github.com/angular/angular/commit/3240d856d942727372a705252f7c8c115394a41e
- https://github.com/angular/angular/releases/tag/19.2.16
- https://github.com/angular/angular/releases/tag/20.3.14
- https://github.com/angular/angular/releases/tag/21.0.1
- https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2.
Risk Information
cvss4
Base: 8.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions. This issue has been patched in version 1.3.2.
Risk Information
cvss4
Base: 6.3
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, working with large buffers in Lua scripts can lead to a stack overflow. Users of Lua rules and output scripts may be affected when working with large buffers. This includes a rule passing a large buffer to a Lua script. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves disabling Lua rules and output scripts, or making sure limits, such as stream.depth.reassembly and HTTP response body limits (response-body-limit), are set to less than half the stack size.
Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions from 8.0.0 to before 8.0.2, a NULL dereference can occur when the entropy keyword is used in conjunction with base64_data. This issue has been patched in version 8.0.2. A workaround involves disabling rules that use entropy in conjunction with base64_data.
Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Access Data Using Our API
Get company history
curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=marks-and-spencer' -H 'apikey: YOUR_API_KEY_HERE'
RapidWhat Do We Measure ?
Incident
Finding
Grade
Digital Assets
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Network Security
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
SBOM (Software Bill of Materials)
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
CMDB (Configuration Management Database)
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Threat Intelligence
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
