Marks and Spencer Company Cyber Security Posture

Total Incidents: According to Rankiteo, MS has faced 14 incidents in the past.

Incident Types: The types of cybersecurity incidents that have occurred include Breach, Cyber Attack and Ransomware.

Total Financial Loss: The total financial loss from these incidents is estimated to be $1.20 billion.

Detection and Response: The company detects and responds to cybersecurity incidents through an enhanced monitoring with strong identity verification, vmware hardening, backup integrity, continuous monitoring and and and third party assistance with professional intermediaries and containment measures with shutting down systems and remediation measures with rebuilding systems and recovery measures with bringing systems back up securely and communication strategy with media channels, including bbc and network segmentation with not heavily segmented and third party assistance with tata consultancy services and and containment measures with shut down systems to prevent further spread and recovery measures with recovery efforts ongoing, full recovery expected by october or november 2025 and communication strategy with calling for greater transparency and cyberattack reporting and and communication strategy with affected customers were notified and containment measures with disabled online shopping orders, disabled click and collect, disabled contactless payments in some stores and communication strategy with letter to customers and remediation measures with restore encrypted virtual machines, sanitize systems and network segmentation with need for stronger network segmentation and enhanced monitoring with faster ransomware detection capabilities.

Common Attack Types: The most common types of attacks the company has faced is Ransomware.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Phone-based social engineering, Help desk, Compromised credentials from TCS, Social Engineering, Third-party supplier, Third-party access and Compromised Credentials.

Average Financial Loss: The average financial loss per incident is $85.99 million.

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Sensitive data, Active Directory database, Personal Information, Order Histories, Home addresses, Phone numbers, Dates of birth, Customer data, Personal customer data, Personal Data and Personally Identifiable Information (PII).

Third-Party Assistance: The company involves third-party assistance in incident response through Professional intermediaries, Tata Consultancy Services.

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Rebuilding systems, Restore encrypted virtual machines, Sanitize systems.

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by shutting down systems, shut down systems to prevent further spread, disabled online shopping orders, disabled click and collect and disabled contactless payments in some stores.

Data Recovery from Ransomware: The company recovers data encrypted by ransomware through Recovery efforts ongoing, Full recovery expected by October or November 2025.

Key Lessons Learned: The key lessons learned from past incidents are Proper training and a challenge process to validate the caller is who they say they are can prevent social engineering attacks. Using valid credentials and built-in tools makes it difficult for security teams to discern if they are compromised or not.Employees should be trained to recognize and report cyber threats promptly. Organizations should foster a culture of transparent and timely communication of cyber threats.Importance of system segmentation and mandatory reporting of cyber incidentsExposed gaps in patch management and incident response processes,Need for stronger network segmentation,Faster ransomware detection capabilities,Robust backup and recovery workflows.

Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Organisations must protect their virtualised assets through strong identity verification, VMware hardening, backup integrity, and continuous monitoring.Implement training and attack simulation training to help employees recognize and respond to cyber threats appropriately.Greater transparency and cyberattack reportingDeploy next-generation endpoint protection, Implement multi-factor authentication.

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Google’s Threat Intelligence Group (GTIG)Date Accessed: mid-2025, and Source: Thomas Richards, Infrastructure Security Practice Director at Black Duck, and Source: BleepingComputer, and Source: BlackFog ReportDate Accessed: 2025-07-16, and Source: Cohesity Survey, and Source: UK Parliament hearing on July 8Date Accessed: 2023-07-08, and Source: Reuters, and Source: TechRadar Pro, and Source: ReutersDate Accessed: 2025-06-19, and Source: BBC, and Source: The Financial Times, and Source: ReliaQuest ReportDate Accessed: 2025-06-05, and Source: BBC News, and Source: BleepingComputer, and Source: Marks & Spencer.

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through were Media channels, including BBC, Calling for greater transparency and cyberattack reporting, Affected customers were notified and Letter to customers.

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: was Reset passwords.

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Strong identity verification,VMware hardening,Backup integrity,Continuous monitoring, Professional intermediaries, Tata Consultancy Services, Faster ransomware detection capabilities.

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Improve employee training and foster a culture of transparent communication, Rebuilding systems and improving segmentation, Accelerated cybersecurity investment, Deployed next-generation endpoint protection and multi-factor authentication across cloud and on-premises infrastructure.

Last Ransom Demanded: The amount of the last ransom demanded was Yes.

Last Attacking Group: The attacking group in the last incident were an Scattered Spider (0ktapus, UNC3944), Cybercriminal groups, Many based in RussiaCybercriminal groups, Many based in Russia, Scattered Spider, DragonForce ransomware group, Scattered Spider (DragonForce), DragonForce, DragonForce hacking collective, DragonForce, Scattered Spider (UNC3944, Octo Tempest), Scattered Spider, Scattered Spider and DragonForce group.

Most Recent Incident Detected: The most recent incident detected was on mid-2025.

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2025-07-16.

Most Significant Data Compromised: The most significant data compromised in an incident were Sensitive data, Active Directory database, Names, Birth Dates, Addresses, Phone Numbers, Household Information, Order Histories, Home addresses, Phone numbers, Dates of birth, Customer data, Customer data, Personal Data and Personally Identifiable Information (PII).

Most Significant System Affected: The most significant system affected in an incident were VMware vSphere environments, ESXi hosts, VCSA and Local councils, Schools, NHS, British Library, Marks & Spencer, Co-op, Harrods and Virtual machines, Contactless payments, Click-and-collect, Online ordering and Online shopping and other areas and Online retail systems, VMware ESXi hosts and Online services and Online Sales, Contactless Payments and Online shopping orders, Click and collect, Contactless payments and VMware ESXi hosts, e-commerce platforms, payment platforms.

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was Professional intermediaries, Tata Consultancy Services.

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Shutting down systems, Shut down systems to prevent further spread, Disabled online shopping orders, Disabled click and collect and Disabled contactless payments in some stores.

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Sensitive data, Active Directory database, Names, Birth Dates, Addresses, Phone Numbers, Household Information, Order Histories, Home addresses, Phone numbers, Dates of birth, Customer data, Customer data, Personal Data and Personally Identifiable Information (PII).

Highest Ransom Demanded: The highest ransom demanded in a ransomware incident was Yes.

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Exposed gaps in patch management and incident response processes,Need for stronger network segmentation,Faster ransomware detection capabilities,Robust backup and recovery workflows.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Organisations must protect their virtualised assets through strong identity verification, VMware hardening, backup integrity, and continuous monitoring., Implement training and attack simulation training to help employees recognize and respond to cyber threats appropriately., Greater transparency and cyberattack reporting, Deploy next-generation endpoint protection, Implement multi-factor authentication.

Most Recent Source: The most recent source of information about an incident are Google’s Threat Intelligence Group (GTIG), Thomas Richards, Infrastructure Security Practice Director at Black Duck, BleepingComputer, BlackFog Report, Cohesity Survey, UK Parliament hearing on July 8, Reuters, TechRadar Pro, Reuters, BBC, The Financial Times, ReliaQuest Report, BBC News, BleepingComputer and Marks & Spencer.

Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing.

Most Recent Customer Advisory: The most recent customer advisory issued was an Reset passwords.

Most Recent Entry Point: The most recent entry point used by an initial access broker were an Social Engineering, Compromised Credentials, Compromised credentials from TCS, Phone-based social engineering, Third-party supplier, Help desk and Third-party access.

Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Weak identity verification procedures in IT help desks, Employee impersonation and unauthorized system access, Compromised credentials and lack of system segmentation, Social Engineering, Password Reset Mechanism, Social engineering and third-party access.

Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Improve employee training and foster a culture of transparent communication, Rebuilding systems and improving segmentation, Accelerated cybersecurity investment, Deployed next-generation endpoint protection and multi-factor authentication across cloud and on-premises infrastructure.