Marks and Spencer Vendor Cyber Rating & Cyber Score

marksandspencer.com
ISOSOC2 Type 1SOC2 Type 2PCI DSSHIPAAGDPR

At M&S, we're dedicated to being the most trusted retailer, prioritising quality and delivering value. Every day, we bring the magic of M&S to our customers, whenever, wherever and however they want to shop with us. For over a century, we've set the standard, doing the right thing and embracing innovation. Today, with over 65,000 colleagues serving 32 million customers globally, we're putting quality products at the heart of everything we do. Tomorrow holds boundless opportunities with us. We're pioneering digital innovation and shaping the future of retail where our values drive every action. We stay close to customers and colleagues, always curious and connected. Our decisions are bold, our actions ambitious. Transparency is paramount, with straightforward, honest communication. We're constantly innovating, always striving for the best. Our focus is on aiming higher and winning together, combined with wise financial decisions to secure our future. Join us at M&S to shape the future of retail.

Marks and Spencer A.I CyberSecurity Scoring

MS

Company Details

Linkedin ID:

marks-and-spencer

Website:

https://jobs.marksandspencer.com/

Employees number:

41,277

Number of followers:

736,458

NAICS:

43

Industry Type:

Retail

Homepage:

marksandspencer.com

IP Addresses:

Scan still pending

Company ID:

MAR_2661945

Scan Status:

In-progress

AI scoreMS Risk Score (AI oriented)

Between 0 and 549

https://images.rankiteo.com/companyimages/marks-and-spencer.jpeg
MS Retail
Updated:
  • Powered by our proprietary A.I cyber incident model
  • Insurance preferes TPRM score to calculate premium
Get a Score Increase
globalscoreMS Global Score (TPRM)

XXXX

https://images.rankiteo.com/companyimages/marks-and-spencer.jpeg
MS Retail
  • Instant access to detailed risk factors
  • Benchmark vs. industry & size peers
  • Vulnerabilities
  • Findings

Marks and Spencer

Critical
Current Score
100
C (Critical)
01000
24 incidents
0 avg impact

Incident timeline with MITRE ATT&CK tactics, techniques, and mitigations.

APRIL 2026
100
MARCH 2026
100
FEBRUARY 2026
100
Breach
04 Feb 2026 • TaskUs, Coinbase, Discord and Marks & Spencer: Coinbase confirms insider breach linked to leaked support tool screenshots
Coinbase Insider Breach Impacting 30 Customers

**Coinbase Confirms Insider Breach Impacting 30 Customers in December Incident** Coinbase has disclosed an insider breach involving a contractor who improperly accessed the personal data of approximately 30 customers in December. The company confirmed the incident after threat actors known as *Shiny Lapsus Hunters* (SLH) briefly posted screenshots of an internal support interface on Telegram, revealing customer details such as names, email addresses, phone numbers, KYC information, wallet balances, and transaction histories. The contractor, who no longer works with Coinbase, was detected by the company’s security team last year. Affected users were notified and provided with identity theft protection services, while regulators were informed as part of standard protocol. This breach is unrelated to a separate January 2025 incident involving TaskUs, an outsourcing firm that provides support services to Coinbase. The screenshots shared by SLH suggest the group may have obtained the data through an insider or by circulating stolen information among threat actors. SLH has previously claimed to have bribed insiders at other firms, including CrowdStrike, to gain access to internal systems. **Rising Threats to Business Process Outsourcing (BPO) Firms** The incident highlights a growing trend of threat actors targeting BPO companies third-party firms handling customer support, IT services, and account management for organizations. Since BPO employees often have access to sensitive systems and data, they have become prime targets for attacks. Common tactics include: - **Bribing insiders** to steal or share customer information, as seen in the Coinbase and TaskUs breaches. - **Social engineering support staff** to gain unauthorized access, such as the Clorox breach, where attackers impersonated an employee to compromise a Cognizant help desk agent, leading to a $380 million lawsuit. - **Compromising BPO employee accounts** to access customer data, as in Discord’s October breach, where a support agent’s account at an outsourced provider was used to extract data from 5.5 million users. Recent attacks on retailers like Marks & Spencer and Co-op have also involved social engineering against support personnel, prompting the U.K. government to issue guidance on mitigating such threats. The shift toward targeting BPOs reflects a broader strategy by threat actors to exploit third-party access rather than directly breaching corporate networks.

100
critical Already minimum
MARCOIDISTAS1770173590
Incident Details -
Type
Insider Threat
Attack Vector
Insider Access
Motivation
Data Theft, Financial Gain
Impact
Data Compromised: Personal data (names, email addresses, phone numbers, KYC information, wallet balances, transaction histories) Systems Affected: Internal support interface Brand Reputation Impact: Yes Identity Theft Risk: Yes
Response
Incident Response Plan Activated: Yes Containment Measures: Contractor terminated, affected users notified Remediation Measures: Identity theft protection services provided to affected users Communication Strategy: Public disclosure, regulatory notifications
Data Breach
Personal Identifiable Information (PII) KYC Information Transaction Histories Wallet Balances Number Of Records Exposed: 30 Sensitivity Of Data: High Data Exfiltration: Yes (via Telegram screenshots) Personally Identifiable Information: Yes
Regulatory Compliance
Regulatory Notifications: Yes
Lessons Learned
Insider threats pose significant risks, especially in third-party contractor relationships. Enhanced monitoring and access controls are critical for mitigating such breaches.
Recommendations
Implement stricter access controls for contractors and third-party vendors Enhance monitoring of internal systems for unauthorized access Provide regular security awareness training for employees and contractors Establish clear protocols for reporting and responding to insider threats
Investigation Status
Completed
Customer Advisories
Affected users notified and provided with identity theft protection services
Initial Access Broker
Entry Point: Contractor access
Post Incident Analysis
Root Causes: Improper access by a contractor, lack of sufficient monitoring for insider threats Corrective Actions: Contractor terminated, affected users notified, identity theft protection services provided, regulatory notifications completed
References
Blog URL Source URL
JANUARY 2026
100
Breach
01 Jan 2026 • Marks & Spencer: Brazil Leads the World in Global Identity Security Survey: RSA ID IQ Report Unveils Top Identity Threats
RSA 2026 Identity-Related Breach Report Findings

**RSA Report: Identity-Related Breaches Surge, Costs Skyrocket in 2026** A new global report from RSA reveals a sharp rise in identity-related breaches, with 69% of organizations experiencing such incidents in the last three years a 27-percentage-point increase year-over-year. The *2026 RSA ID IQ Report*, based on insights from over 2,100 cybersecurity, IAM, and IT professionals, highlights escalating risks, financial impacts, and emerging attack vectors in identity security. Key findings include: - **Breach frequency and costs**: Identity-related breaches have surged by 64% relative to the previous year, with 45% of organizations reporting costs exceeding IBM’s typical breach benchmark. Notably, 24% faced losses exceeding $10 million, a three-point increase from 2025. - **Top threats**: IT help desk bypass and social engineering attacks have become a major concern, with 65% of organizations worried about a repeat of high-profile breaches like those at MGM Resorts, Caesars Entertainment, and Marks & Spencer. Over half (51%) now view service desk attacks as their most significant risk. - **Passwordless adoption**: Brazil leads globally in passwordless authentication, with 50% of respondents using it at least half the time nine points above the global average. - **AI in cybersecurity**: While 83% of professionals believe AI will benefit cybersecurity more than cybercrime in the next three years, 91% of organizations plan to integrate AI into their tech stacks this year. Brazil stands out for its high AI adoption but also expresses the greatest skepticism about its security benefits. RSA CEO Greg Nelson emphasized the urgency of addressing identity vulnerabilities, stating that the "likelihood of a breach and the cost of inaction are too high for leaders to tolerate the status quo." The report underscores the need for organizations to reassess their identity security strategies amid evolving threats.

100
critical Already minimum
MAR1768480120
Incident Details -
Type
Data Breach
Attack Vector
Social Engineering IT Help Desk Bypass
Vulnerability Exploited
Identity and Access Management (IAM) Failures
Impact
Financial Loss: > $10M (for 24% of organizations)
Data Breach
Type Of Data Compromised: Identity-Related Data Sensitivity Of Data: High (Personally Identifiable Information, Access Credentials) Personally Identifiable Information: Yes
Lessons Learned
Identity-related breaches are increasing in frequency and cost, with IT help desk bypass and social engineering emerging as significant threats. Organizations must prioritize securing their identity estate and consider adopting passwordless authentication and AI-driven cybersecurity measures.
Recommendations
Assess and strengthen identity and access management (IAM) capabilities. Prioritize passwordless authentication adoption. Implement AI-driven cybersecurity solutions to enhance threat detection and response. Enhance IT help desk security protocols to prevent social engineering attacks. Monitor and address identity-related risks proactively.
Investigation Status
['Report Findings (No Specific Incident Investigation)']
Stakeholder Advisories
Leaders should act quickly to secure their identity estate and prioritize actions to mitigate identity-related risks.
Post Incident Analysis
Identity and Access Management (IAM) Failures Social Engineering Attacks IT Help Desk Bypass Strengthen IAM capabilities Adopt passwordless authentication Implement AI-driven cybersecurity solutions Enhance IT help desk security protocols
References
Blog URL Source URL
DECEMBER 2025
100
Cyber Attack
29 Dec 2025 • Adidas, Heathrow Airport, Harrods, Marks and Spencer, Co-op Group and Jaguar Land Rover: How 2025 Became The Year Of The Cyberattack For British Businesses
None

**2025: A Year of Rising Costs—and Escalating Cyber Threats for UK Businesses** As 2025 draws to a close, UK businesses and charities have faced a surge in financial pressures—from soaring employment costs and supply chain disruptions to oil and tariff shocks. Yet, one of the most damaging expenses has been the fallout from cyberattacks, which have hit nearly half of British companies and 30% of charities over the past year. High-profile victims include retail giants **Marks & Spencer, Adidas, and the Co-op Group**, as well as **Heathrow Airport, Harrods, and Jaguar Land Rover (JLR)**. The public sector hasn’t been spared either: **Germany’s parliament** and the **UK Foreign Office** (breached in October) were among those targeted. Attacks ranged from phishing scams to full-scale digital shutdowns, with some incidents costing hundreds of millions. The scale of cybercrime has reached staggering proportions. **Cybersecurity Ventures** estimates the global cost of cyberattacks in 2025 at **$10.5 trillion (£7.8 trillion)**—a figure that would rank cybercrime as the world’s third-largest economy, trailing only the US and China. The financial and operational toll underscores the growing threat to organizations across sectors.

100
critical Already minimum
ADIHEAHARMARTHEJAG1767017696
Incident Details -
Type
phishing data breach digital shutdown ransomware
Impact
Financial Loss: hundreds of millions of pounds Operational Impact: digital shutdown
References
Blog URL Source URL
NOVEMBER 2025
100
OCTOBER 2025
100
Cyber Attack
14 Oct 2025 • Marks & Spencer, Jaguar Land Rover and Co-op Group: Cyber-attacks rise by 50% in past year, UK security agency says
UK Surge in Cyber-Attacks by State-Backed Threats

**UK Faces Surge in Cyber-Attacks as State-Backed Threats Intensify** The UK’s cybersecurity landscape has grown increasingly volatile, with "highly significant" cyber-attacks rising by 50% over the past year, according to the National Cyber Security Centre (NCSC). The agency, part of GCHQ, now responds to a nationally significant attack more than every other day a sharp increase driven by ransomware, state-sponsored threats, and the expanding digital attack surface. In its annual review, the NCSC identified China, Russia, Iran, and North Korea as the primary state-backed adversaries, with Russia described as "capable and irresponsible" and China as "highly sophisticated." The report highlights a surge in ransomware incidents, often carried out by criminal groups, alongside state-aligned hacktivism. Over the past year, the NCSC handled 429 cyber incidents nearly half classified as nationally significant including 18 "highly significant" attacks that disrupted government operations, essential services, or the economy. Victims included major retailers like Marks & Spencer and the Co-op Group. Government officials, including Chancellor Rachel Reeves and Security Minister Dan Jarvis, have urged businesses of all sizes to treat cyber-resilience as a board-level priority, warning that hostile activity has become "more intense, frequent, and sophisticated." GCHQ Director Anne Keast-Butler emphasized the need for proactive risk management, stating, "Prioritise cyber risk management, embed it into your governance, and lead from the top." The NCSC also noted the growing role of artificial intelligence in cyber threats, predicting that AI will "almost certainly pose cyber-resilience challenges" through at least 2027. While no AI-initiated attacks have been confirmed, adversaries are already leveraging the technology to refine their tactics. Meanwhile, Russia’s influence extends beyond state operations, inspiring hacktivist groups targeting the UK, US, and NATO allies. Recent disruptions such as the cyber-attack on Jaguar Land Rover, which halted manufacturing, and the airport outages affecting London Heathrow underscore the real-world consequences of these threats. Domestic cybercrime remains a concern as well. Last week, two 17-year-olds were arrested in Hertfordshire over an alleged ransomware attack on the Kido nursery chain, exposing children’s data. NCSC CEO Richard Horne warned of the emotional toll on victims, noting, "I’ve sat in too many rooms with individuals deeply affected by these attacks the worry, the sleepless nights, the disruption to staff, suppliers, and customers." With the UK recording its highest level of cyber threat activity in nine years, the NCSC’s findings signal a critical shift in the severity and frequency of digital attacks, demanding heightened vigilance across sectors.

100
critical Already minimum
MARCO-JAG1771151062
Incident Details -
Type
ransomware state-sponsored hacktivism
Motivation
geopolitical financial gain disruption
Impact
government operations essential services retail manufacturing aviation halted manufacturing airport outages
Data Breach
children’s data personally identifiable information Sensitivity Of Data: high
Lessons Learned
Cyber-resilience must be treated as a board-level priority, with proactive risk management and governance embedded at the highest levels. The emotional and operational toll of cyber-attacks on victims is significant.
Recommendations
Businesses of all sizes should prioritize cyber risk management, embed it into governance, and lead from the top. Enhanced vigilance and preparedness are critical given the rising threat landscape.
Stakeholder Advisories
Government officials urge businesses to treat cyber-resilience as a priority, warning of intensified hostile activity. GCHQ Director emphasizes proactive risk management.
Post Incident Analysis
state-backed threats ransomware hacktivism expanding digital attack surface prioritize cyber risk management embed governance enhance vigilance
References
Blog URL Source URL
SEPTEMBER 2025
100
Ransomware
02 Sep 2025 • Marks & Spencer
DragonForce Ransomware Cartel Emerges from Conti’s Leaked Source Code

Marks & Spencer (M&S), a prominent UK retailer, fell victim to a coordinated ransomware attack linked to the **DragonForce** cartel and its affiliate **Scattered Spider**. The incident involved the deployment of DragonForce-built ransomware, leveraging Conti’s leaked source code with advanced encryption (ChaCha20 + RSA) and network-spreading capabilities via SMB. The attack targeted both local and shared network storage, with operators threatening to **delete decryptors and leak stolen data** if ransom demands were unmet by deadlines (September 2 and 22).The breach disrupted M&S’s operations, risking **customer data exposure**, financial fraud, and reputational damage due to media coverage. DragonForce’s cartel model—recruiting affiliates like Devman and Scattered Spider—amplified the attack’s sophistication, combining initial access tactics with aggressive data exfiltration. While the full scope of compromised data (e.g., payment details, personal records) remains undisclosed, the incident aligns with DragonForce’s pattern of **high-impact extortion**, including threats to publish sensitive information. The attack underscores the escalating risks posed by ransomware-as-a-service (RaaS) ecosystems, where collaborative cybercriminal groups exploit enterprise vulnerabilities for maximal disruption and profit.

100
critical Already minimum
MAR1193411110425
Incident Details -
Type
ransomware cartel-style cybercrime operation affiliate-based attack
Attack Vector
SMB (Server Message Block) exploitation lateral movement via network shares recruitment of affiliates for branded variants partnerships with initial access brokers (e.g., Scattered Spider)
Motivation
financial gain dominance in ransomware ecosystem recruitment of affiliates disruption of rival groups
Impact
local storage network shares via SMB encryption of files potential data leaks (threatened for September 2 and 22) disruption of rival ransomware operations (e.g., BlackLock, Ransomhub) potential reputational damage to affected entities (e.g., Marks & Spencer) undermining trust in rival ransomware groups
Response
recommended as a defense measure recommended for unusual access to shared resources
Data Breach
threatened (e.g., leaks scheduled for September 2 and 22) ChaCha20 + RSA per-file encryption 10-byte metadata block (encodes mode, percentage, size) supports full (0x24), partial (0x25), and header-only (0x26) modes
Lessons Learned
Ransomware groups are evolving into cartel-like structures to consolidate power and resources. Affiliate recruitment and branded variants increase the scale and complexity of attacks. Partnerships with initial access brokers (e.g., Scattered Spider) amplify threat capabilities. Aggressive tactics (e.g., defacing rival leak sites) disrupt the cybercriminal ecosystem. Legacy ransomware code (e.g., Conti) continues to fuel new operations.
Recommendations
Implement robust backup practices to mitigate encryption impacts. Restrict lateral movement via network segmentation. Monitor for unusual access to shared resources (e.g., SMB). Apply consistent patching and endpoint protection. Conduct user awareness training to prevent initial access exploits. Defend against affiliate-based attacks by tracking emerging ransomware strains.
Investigation Status
['ongoing (as of latest reports)']
Initial Access Broker
enterprise environments retailers (e.g., Marks & Spencer) rival ransomware groups (e.g., BlackLock, Ransomhub)
Post Incident Analysis
Exploitation of Conti’s leaked source code for new ransomware development. Leveraging affiliate networks to scale attacks (e.g., Devman, Scattered Spider). Use of SMB for lateral movement and network-wide encryption. Cartel-like coordination to dominate the ransomware ecosystem.
References
Blog URL Source URL
AUGUST 2025
100
Cyber Attack
29 Aug 2025 • Marks & Spencer (M&S)
Cyber Attacks on UK Retailers Including M&S, Co-op, Cartier, Harrods, and LVMH

Marks & Spencer (M&S) suffered a significant cyber attack executed by the hacking group **ScatteredSpider**, resulting in a **£300 million loss in profits**. The attack disrupted M&S’s systems, highlighting the severe financial and operational consequences even for well-established brands. The incident underscores the escalating threat landscape, where sophisticated cybercriminals—empowered by AI and **Cybercrime-as-a-Service (CaaS)**—target high-profile organizations. Beyond immediate financial damage, the breach eroded customer trust, increased recovery costs, and exposed vulnerabilities in M&S’s cybersecurity posture. The attack serves as a stark warning to businesses of all sizes, emphasizing the need for **proactive security measures** rather than reactive responses. With cyber insurance premiums rising and regulatory pressures (e.g., the upcoming **Cyber Security and Resilience Bill**) mandating resilience, M&S’s case illustrates how inadequate defenses can lead to **long-term reputational harm** and **operational disruptions**, particularly when critical systems or financial data are compromised.

100
critical Already minimum
MAR628082925
Incident Details -
Type
Cyber Attack Ransomware Phishing Supply Chain Attack
Attack Vector
AI-driven attacks Cybercrime-as-a-Service (CaaS) Ransomware Phishing Supply Chain Compromise
Motivation
Financial gain Disruption Data theft
Impact
Financial Loss: £64 billion (collective UK businesses); £300 million (M&S alone) Operational Impact: Significant disruption to business operations, particularly for SMEs Revenue Loss: £300 million (M&S); £27 billion annual revenue loss potential for UK businesses without cybersecurity investment Brand Reputation Impact: Severe for smaller/lesser-known companies; manageable for well-established brands
Regulatory Compliance
Regulatory Notifications: Cyber Security and Resilience Bill (upcoming, 2025)
Lessons Learned
Proactive cybersecurity measures are significantly more cost-effective than reactive responses (up to 10x cost savings). AI and Cybercrime-as-a-Service (CaaS) are democratizing cyber attacks, increasing threat sophistication. Cyber insurance is becoming a necessity, with premiums reducible by up to 75% through measures like XDR, MFA, and vulnerability scanning. Outsourcing cybersecurity improves IT efficiency, performance, and reduces downtime for 68% of businesses. Strong cybersecurity credentials can drive revenue growth and customer trust, especially as consumers become more cyber-aware.
Recommendations
Shift from reactive to proactive cybersecurity strategies to mitigate financial and operational risks. Invest in advanced security measures such as XDR platforms, multi-factor authentication (MFA), and vulnerability scanning. Prioritize cyber insurance to comply with upcoming regulations (e.g., Cyber Security and Resilience Bill 2025) and reduce premiums through risk mitigation. Outsource cybersecurity to leverage external expertise, especially for SMEs lacking in-house capabilities. View cybersecurity as a revenue driver, not just a cost center, to gain competitive advantage and customer trust. Educate stakeholders on the financial and operational benefits of early cybersecurity investment.
Investigation Status
Ongoing (general trend analysis; specific incidents may vary)
Customer Advisories
Customers advised to monitor communications from affected retailers for potential data breach notifications or protective measures.
Stakeholder Advisories
Businesses urged to adopt proactive cybersecurity measures to mitigate risks from evolving threats (AI, nation-states, CaaS).
Initial Access Broker
Retail systems Luxury brand databases Supply chain partners
Post Incident Analysis
Underinvestment in proactive cybersecurity measures Over-reliance on in-house teams without external expertise Failure to adapt to evolving threats (AI, CaaS, nation-state actors) Lack of comprehensive cyber insurance and resilience planning Increase cybersecurity budgets (77% of UK businesses planning to do so). Implement XDR, MFA, and vulnerability scanning to reduce insurance premiums. Adopt outsourced cybersecurity solutions for specialized expertise. Comply with upcoming regulations (e.g., Cyber Security and Resilience Bill 2025). Position cybersecurity as a strategic revenue driver, not just a protective measure.
References
Blog URL Source URL
JULY 2025
100
Ransomware
15 Jul 2025 • Belk and Marks & Spencer: Marks & Spencer hackers hit US retailer Belk
DragonForce Ransomware Group Strikes US Retailer Belk in Major Cyberattack

**DragonForce Ransomware Group Strikes US Retailer Belk in Major Cyberattack** The US department store chain **Belk** has fallen victim to a cyberattack by the **DragonForce ransomware group**, the same threat actor behind the recent **£300 million ($403 million) attack on UK retailer Marks & Spencer (M&S)**. The breach, disclosed in early June via a filing with the **New Hampshire Attorney General’s Office**, involved unauthorized access to corporate systems and sensitive customer data. Researchers from **Cybernews** confirmed the legitimacy of the leak, which includes **names, dates of birth, addresses, phone numbers, email addresses, and order histories** data that could be exploited by malicious actors, data brokers, or insurance companies for profiling. The exposed information also encompasses **store coupons, employee records, and data from Belk’s mobile app infrastructure**. While the exact number of affected individuals remains unclear, estimates suggest **up to a million users** may be impacted, though some accounts are likely test profiles. DragonForce, which first emerged in **2023**, has rapidly expanded its operations, targeting **104 organizations in the past year**. The group operates a **dark web blog** where it lists victims and shares stolen data. In Belk’s case, attackers claim to have exfiltrated **156GB of company data**, including backups and employee profiles. The gang initially stated it had no intention of "destroying" Belk’s business but resorted to destructive measures after the company refused to pay the ransom. The attack has had **significant financial repercussions** for M&S, forcing its online clothing operations offline, disrupting food supply chains, and wiping **over £1 billion from its stock market value**. Online sales and trading profits in the affected division have been "heavily impacted" due to the suspension of e-commerce services. Belk, founded in **1888**, operates nearly **300 stores across 16 US states** and reported **$4 billion in revenue last year**. The incident underscores the growing threat posed by ransomware groups like DragonForce, which has also **hijacked infrastructure from rival gangs** such as **BlackLock, Mamona, and RansomHub** in a bid to dominate the cybercriminal landscape.

100
critical Already minimum
BELMAR1770616665
Incident Details -
Type
Ransomware
Motivation
Financial gain
Impact
Data Compromised: 156GB of company data, including backups and employee profiles Systems Affected: Corporate systems, mobile app infrastructure, e-commerce services (implied from M&S impact) Operational Impact: Disruption of online operations, potential supply chain disruptions Brand Reputation Impact: Significant (stock market value drop for M&S, public disclosure) Identity Theft Risk: High (exposed PII)
Response
Third Party Assistance: Cybernews (researchers) Communication Strategy: Filing with New Hampshire Attorney General’s Office
Data Breach
Names Dates of birth Addresses Phone numbers Email addresses Order histories Store coupons Employee records Mobile app infrastructure data Number Of Records Exposed: Up to 1 million users (estimated) Sensitivity Of Data: High (Personally Identifiable Information, employee data) Data Exfiltration: Yes (156GB of data) Data Encryption: Yes (ransomware strain) Personally Identifiable Information: Yes
Regulatory Compliance
Regulatory Notifications: Filing with New Hampshire Attorney General’s Office
Initial Access Broker
Data Sold On Dark Web: Potential (group operates dark web blog)
References
Blog URL Source URL
JULY 2025
100
Ransomware
01 Jul 2025 • Marks and Spencer (M&S)
Series of Cyber Attacks on UK Retailers (April–June 2024)

Marks and Spencer (M&S) suffered a **significant ransomware attack** over the Easter weekend, with repercussions lasting over two months. The attack **suspended all online orders** and **disabled contactless payments** in physical stores, severely disrupting operations. While customer data was accessed, M&S confirmed that **payment details and passwords remained secure**. However, the financial fallout was catastrophic—**£300 million was wiped from its market value**, marking it as the **most financially damaging cyber attack in UK retail history**. Recovery has been slow, with some online ordering and delivery services still unavailable weeks later. The attack not only crippled revenue streams but also eroded customer trust, risking long-term reputational harm. The incident aligns with a broader trend of retailers being targeted for their vast customer databases and critical payment infrastructure, amplifying operational and financial vulnerabilities.

100
critical Already minimum
MAR5392253090725
Incident Details -
Type
Ransomware (M&S) Cyber Attack (Harrods, Co-op) Data Breach (Adidas) IT Outage (H&M, suspected cyber attack)
Attack Vector
Third-party customer-service provider (Adidas) Unauthorised access attempt (Harrods) Ransomware (M&S, linked to DragonForce RaaS) Potential exploitation of smart building systems/IoT (speculative for H&M/Co-op) Unguarded network sockets or physical access (theoretical, per RICS)
Vulnerability Exploited
Third-party vendor security (Adidas) Smart building systems (IoT, access control, CCTV, HVAC) (theoretical)
Motivation
Financial gain (ransomware, data theft) Disruption (operational impact) Data exfiltration (customer PII)
Impact
£300m market value loss (M&S) Up to £73m revenue loss per minute for payment outages (industry estimate) Customer names/contact details (Adidas, Co-op) Customer information (M&S, no payment details/passwords) None confirmed (Harrods, H&M) Ecommerce, contactless payments (M&S) Internal IT systems, internet access (Harrods) Payments systems (H&M, in-store) IT systems (Co-op, leading to empty shelves) Third-party customer service (Adidas) >2 months (partial recovery for M&S) Minimal (Harrods) 2 hours (H&M, some locations) Short-term (Co-op) Suspended online orders, no contactless payments (M&S) Empty shelves (Co-op) In-store payment failures (H&M) Internet access paused in stores (Harrods) None (Adidas) Significant (M&S, Co-op, H&M during outage) Likely (M&S, Co-op, H&M) High (M&S, Co-op, H&M) Moderate (Harrods, Adidas) Low (Adidas, Co-op: names/contact details only) None (all incidents)
Response
Yes (M&S, Harrods, Co-op) Likely (M&S, Co-op for forensic investigation) Restricted internal IT systems, paused internet access (Harrods) Shut down parts of IT systems (Co-op) Suspended online orders (M&S) Partial restoration of online services (M&S) Ongoing (M&S) Quick recovery (H&M, Harrods) Public disclosures (all) Customer apologies (H&M, M&S)
Data Breach
Customer names/contact details (Adidas, Co-op) Customer information (M&S, no specifics) Low (Adidas, Co-op: PII but no financial data) Yes (Adidas, Co-op, M&S) No evidence (Harrods) Yes (names, contact details for Adidas/Co-op) Unspecified (M&S)
Regulatory Compliance
Potential GDPR (Adidas, Co-op, M&S for PII exposure) Likely (ICO for Adidas, Co-op, M&S)
Lessons Learned
Retailers must secure third-party vendors, smart building systems, and IoT devices to reduce attack surfaces. Rapid containment (e.g., Co-op’s IT shutdown) can mitigate ransomware deployment. Public-facing disruptions (e.g., payment outages) erode customer trust and revenue, highlighting the need for resilient backup systems and transparent communication.
Recommendations
Implement zero-trust architecture for third-party access. Audit and segment IoT/building management systems from critical networks. Develop playbooks for ransomware attacks, including offline payment contingencies. Enhance employee training on physical security (e.g., unguarded network sockets). Conduct regular red-team exercises simulating supply-chain and RaaS attacks.
Investigation Status
Ongoing (M&S) Completed (Adidas, Co-op, Harrods) Unconfirmed (H&M)
Customer Advisories
Apologies and service updates (H&M, M&S, Co-op) Data breach notifications (Adidas, Co-op)
Stakeholder Advisories
Market updates (M&S £300m loss)
Initial Access Broker
Third-party vendor (Adidas) Potential physical access (unguarded sockets/IoT for others) Customer databases (M&S, Adidas, Co-op) Payment systems (H&M, M&S)
Post Incident Analysis
Third-party vendor vulnerabilities (Adidas) Insecure IoT/building systems (theoretical for Co-op/H&M) RaaS proliferation (DragonForce for M&S) Lack of payment system redundancy (H&M, M&S) Vendor security audits (Adidas) IT system segmentation (Co-op, Harrods) Offline payment fallback (H&M, M&S)
References
Blog URL Source URL
JUNE 2025
100
Ransomware
16 Jun 2025 • Marks & Spencer (M&S)
2025 Retail Cyberattacks: Marks & Spencer, Co-op, and Louis Vuitton Breaches

In 2025, Marks & Spencer (M&S) suffered a high-profile cyberattack over Easter, involving **ransomware**, **payment system disruption**, and **third-party exploitation**. The breach caused **major operational downtime**, leading to significant **financial losses** due to halted transactions and recovery efforts. The attack disrupted business continuity, eroded **customer trust**, and exposed vulnerabilities in M&S’s supply chain and internal security posture. While the exact scale of data exposure remains undisclosed, the incident highlighted the retailer’s susceptibility to **multi-vector attacks**, combining credential abuse, lateral movement, and ransomware deployment. The fallout included reputational damage, regulatory scrutiny, and the urgent need for overhauls in **identity access management**, **real-time threat detection**, and **incident response protocols**. The attack underscored how even established brands with sophisticated defenses remain at risk without **proactive visibility** across digital infrastructure.

100
critical Already minimum
MAR1993619102425
Incident Details -
Type
Data Breach Ransomware (M&S) Third-Party Exploitation Payment System Disruption
Attack Vector
Stolen Credentials (Third-Party Vendors) Unmonitored Endpoints API Exploitation Poorly Secured User Accounts Phishing/Social Engineering (Potential) Known Vulnerabilities (Unpatched Systems)
Vulnerability Exploited
Identity and Access Control Weaknesses Lack of Centralized Log Management Unsegmented Networks Unmonitored API Traffic Delayed Patch Management
Motivation
Financial Gain (Ransomware) Data Theft (Customer Records) Disruption of Operations
Response
Network Segmentation (Recommended) Isolation of Affected Systems (Recommended) Centralized Log Management Real-Time Threat Detection Patch/Vulnerability Management Identity and Access Control Reforms (MFA, Least Privilege) Immutable Backups (Recommended) System Restoration Protocols Transparency in Public Disclosures (Recommended) Stakeholder/Regulator Notifications
Data Breach
Customer Records (Co-op: 6.5M) Potential Payment Information (M&S) Personally Identifiable Information (PII) Number Of Records Exposed: 6.5 million (Co-op) Sensitivity Of Data: High (PII, Payment Data)
Lessons Learned
Proactive visibility across identity, access, and infrastructure is critical to detect threats early. Centralized log management and real-time threat detection are essential to limit breach impact. Zero Trust and network segmentation reduce lateral movement and blast radius. API and application monitoring must be prioritized to detect anomalous activity. Automated vulnerability management and patching reduce exposure to known exploits. Security culture and human resilience (e.g., phishing training) are vital to mitigate insider threats. Incident response plans must include immutable backups, clear communication protocols, and post-incident reviews. Transparency in breach disclosures helps retain customer trust and brand reputation.
Recommendations
Adopt a visibility-first security posture with centralized log management and SIEM capabilities. Enforce least-privilege access, MFA, and continuous monitoring for identity and access controls. Implement network segmentation and Zero Trust principles to limit breach impact. Monitor API traffic and application behavior in real time for early threat detection. Automate vulnerability scanning and prioritize patching based on risk/exploitability. Invest in regular, scenario-based security training for employees to reduce human error. Develop and test incident response plans with tabletop exercises and immutable backups. Ensure transparent, timely communication with stakeholders, regulators, and customers during breaches. Conduct thorough post-incident root cause analyses to harden systems and share lessons industry-wide. Treat cybersecurity as a board-level priority tied to business continuity, not just an IT issue.
Investigation Status
['Ongoing (Louis Vuitton in early disclosure; M&S and Co-op likely concluded)']
Initial Access Broker
Third-Party Vendors (Compromised Credentials) Unmonitored Endpoints API Exploitation Reconnaissance Period: Days to weeks (undetected dwell time) Customer Databases Payment Systems Brand Reputation
Post Incident Analysis
Lack of centralized visibility into digital environments (logs, telemetry, user activity). Weak identity/access controls (stolen credentials, unmonitored endpoints). Siloed logging and delayed threat detection. Insufficient network segmentation enabling lateral movement. Unpatched vulnerabilities and poor API security. Inadequate security culture/training (phishing, social engineering risks). Deploy unified log management and real-time threat detection platforms. Enforce Zero Trust architecture with strict access controls and MFA. Segment networks to limit breach impact and lateral movement. Enhance API/application monitoring for behavioral anomalies. Automate vulnerability scanning and prioritize high-risk patching. Integrate security awareness into organizational culture via regular training. Test incident response plans with simulations and ensure immutable backups. Improve post-incident communication transparency to retain customer trust.
References
Blog URL Source URL
JUNE 2025
100
Breach
13 Jun 2025 • Cartier, Marks & Spencer and Victoria’s Secret: UPDATE: May Cyber Attack Expected to Cost Victoria’s Secret $20 Million
Retail Cyberattacks Surge: Victoria’s Secret, The North Face, and Cartier Among Latest Victims

**Retail Cyberattacks Surge: Victoria’s Secret, The North Face, and Cartier Among Latest Victims** A wave of cyberattacks has targeted major retailers in recent weeks, disrupting operations and exposing customer data. Victoria’s Secret, The North Face, and Cartier are among the latest brands to report security breaches, highlighting the growing threat to the retail sector. **Victoria’s Secret Hit by Undisclosed Cyberattack** Victoria’s Secret experienced a security incident in late May, forcing the company to shut down its website and pause some in-store services from **May 26 to May 29, 2025**. While stores remained open, the outage delayed the company’s fiscal Q1 earnings report, though financial results released on **June 11** showed net sales of **$1.35 billion**, exceeding expectations. However, the breach is projected to cost the company **$20 million in Q2 net sales** due to service disruptions. **The North Face and Cartier Report Separate Breaches** The North Face, owned by **VF Corp.**, disclosed a **"small-scale" credential-stuffing attack** in **April 2025**, where hackers used leaked login details from other breaches to access customer accounts. No financial data was compromised, but names and emails were exposed. Luxury brand **Cartier** also confirmed a breach, revealing that an unauthorized party accessed customer data, including **purchase history, shipping addresses, birth dates, and phone numbers**. The company did not specify when the attack occurred. **Retail Sector Under Siege** These incidents follow a string of attacks on other retailers this month, including **Marks & Spencer, Dior, Harrods, and Adidas**. The Adidas breach, linked to a third-party customer service provider, underscored the risks of supply chain vulnerabilities. Cybersecurity experts warn that retailers are prime targets due to the vast amounts of sensitive customer data they handle, with **46% of retail security professionals reporting data loss from attacks in the past year**. The financial and reputational toll is significant companies face **network outages, customer account compromises, and long-term trust erosion**, with some losing over **10% of annual revenue** after breaches. While details of the Victoria’s Secret attack remain undisclosed, the incident reflects a broader trend of **coordinated or opportunistic attacks** on the retail industry.

100
critical Already minimum
VICMARCAR1772649374
Incident Details -
Type
Data Breach Credential Stuffing Cyberattack
Attack Vector
Credential Stuffing Unauthorized Access
Impact
Financial Loss: $20 million in Q2 net sales (projected for Victoria’s Secret) Data Compromised: Customer data including names, emails, purchase history, shipping addresses, birth dates, and phone numbers Websites In-store services Downtime: May 26 to May 29, 2025 (Victoria’s Secret) Operational Impact: Delayed fiscal Q1 earnings report, paused in-store services Brand Reputation Impact: Long-term trust erosion
Response
Shut down website Paused in-store services
Data Breach
Names Emails Purchase history Shipping addresses Birth dates Phone numbers Sensitivity Of Data: High (Personally Identifiable Information) Personally Identifiable Information: Yes
Lessons Learned
Retailers are prime targets due to vast amounts of sensitive customer data; supply chain vulnerabilities pose significant risks.
References
Blog URL Source URL
JUNE 2025
100
Ransomware
01 Jun 2025 • Harrods, Marks & Spencer, Co-Op and British Horseracing Authority: British Horseracing Authority hit by ransomware
British Horseracing Authority (BHA) Ransomware Attack

**UK Organizations Face Rising Ransomware Threats as Cyberattacks Intensify** The British Horseracing Authority (BHA) became the latest UK organization to suffer a ransomware attack in early June 2025, compromising multiple servers within its IT infrastructure. While core racing operations and general administration remained unaffected, the incident forced some IT staff to work remotely as authorities worked to contain the breach. The responsible ransomware group has not been identified, with details kept confidential for security reasons. The attack is part of a broader surge in cyber threats targeting Western entities, particularly in the UK. Recent victims include retail giants Marks & Spencer, which fell to the DragonForce ransomware and took five weeks to recover, as well as Co-Op and Harrods, both hit in the past two months. Cybercriminals are increasingly drawn to Western organizations due to two key factors: financial incentives businesses in these regions are more likely to pay ransoms to avoid operational collapse and perceived security gaps, where weak defenses make breaches easier and more profitable. Ransomware tactics have also grown more aggressive. Beyond encrypting data, attackers now employ *double extortion*, stealing sensitive information before locking systems and threatening to leak it on the dark web if demands aren’t met. In rare cases, they escalate to *triple extortion*, targeting victims’ customers and partners to inflict reputational damage. As cyber threats evolve in sophistication, the long-term impact on businesses and public institutions remains a pressing concern. The BHA incident underscores the escalating risks faced by organizations across sectors, with no clear resolution in sight.

100
critical Already minimum
HARMARTHEBRI1769526687
Incident Details -
Type
Ransomware
Motivation
Financial gain, exploitation of perceived security gaps
Impact
Systems Affected: Multiple servers within IT infrastructure Operational Impact: IT staff worked remotely during containment
Response
Containment Measures: IT staff worked remotely to contain the breach
Investigation Status
['Ongoing']
References
Blog URL Source URL
MAY 2025
100
Cyber Attack
22 May 2025 • Harrods, Marks & Spencer, Co-op and Peter Green Chilled: Ransomware attack hits food supply chain, exposes retail risks
Ransomware Attack on Peter Green Chilled Disrupts UK Food Supply Chain

**Ransomware Attack on Peter Green Chilled Disrupts UK Food Supply Chain** A ransomware attack on **Peter Green Chilled**, a key distributor of refrigerated goods to major UK supermarkets, has caused significant disruptions to food deliveries across the country. The incident adds to a growing wave of cyberattacks targeting the retail and logistics sectors, following recent breaches at **Marks & Spencer, the Co-op, and Harrods**. The attack has exposed vulnerabilities in the UK’s supply chain, leading to delays, potential shortages, and concerns over consumer panic buying. Experts warn that such disruptions highlight the high stakes of cybersecurity in retail, where even brief outages can ripple through digital and physical operations. **Andy Norton**, European Cyber Risk Officer at **Armis**, emphasized that the sector’s reliance on digital supply chains, operational continuity, and customer data makes it a prime target. Data from **Armis Labs** shows **41% of retailers** have faced increased cyber threats in the past six months, with **79% of IT decision-makers** prioritizing proactive cybersecurity measures in the coming year. However, nearly half of surveyed retailers admit past breaches have left their systems inadequately secured, while **46% struggle with evolving regulatory complexities**. Security analysts, including **Nir Dvorkin** of **Cynet Security**, link the attack to **Scattered Spider (UNC3944)**, a group known for sophisticated tactics like **phishing, SIM-swapping, and help desk impersonation**. The group’s methods blend social engineering with the exploitation of legitimate remote access tools, making detection difficult. Dvorkin stressed that these attacks are **not opportunistic but meticulously planned** to bypass defenses. To counter such threats, experts recommend a **layered defense strategy**, including **enforced multi-factor authentication (MFA), restricted remote access, and employee training** to recognize social engineering attempts. Despite growing awareness **82% of retail employees know how to report suspicious activity** only **46% of organizations** claim real-time detection and response capabilities. With high-profile groups like **Anonymous, DarkSide, and APT41** posing persistent threats, the retail sector faces mounting pressure to strengthen cyber defenses. The attack on Peter Green Chilled underscores how digital threats now directly impact the physical supply of essential goods, reinforcing the need for **enhanced security, training, and regulatory alignment**.

100
critical Already minimum
THEHARMARPET1770508437
Incident Details -
Type
Ransomware
Attack Vector
Phishing SIM-swapping Help desk impersonation Exploitation of legitimate remote access tools
Impact
Operational Impact: Disruptions to food deliveries, delays, potential shortages, and concerns over consumer panic buying
Lessons Learned
The attack underscores the high stakes of cybersecurity in retail, where even brief outages can ripple through digital and physical operations. Retailers must adopt a layered defense strategy, including enforced multi-factor authentication (MFA), restricted remote access, and employee training to recognize social engineering attempts.
Recommendations
Enforced multi-factor authentication (MFA) Restricted remote access Employee training to recognize social engineering attempts Layered defense strategy Enhanced monitoring and real-time detection capabilities
Post Incident Analysis
Root Causes: Reliance on digital supply chains, inadequate cybersecurity measures, and evolving regulatory complexities. Nearly half of surveyed retailers admit past breaches have left their systems inadequately secured.
References
Blog URL Source URL
MAY 2025
100
Cyber Attack
20 May 2025 • Tesco, Sainsbury’s, Waitrose, Asda, Peter Green Chilled, Morrisons, Marks & Spencer, Co-op and Aldi: Supplier to Tesco, Aldi and other supermarkets hit with ransomware
UK Food Logistics Firm Hit by Ransomware, Disrupting Major Supermarket Supply Chains

**UK Food Logistics Firm Hit by Ransomware, Disrupting Major Supermarket Supply Chains** A ransomware attack on Peter Green Chilled, a key logistics provider for major UK supermarkets, has disrupted order processing for retailers including Tesco, Sainsbury’s, Asda, Waitrose, Co-op, Morrisons, M&S, and Aldi. The incident, which occurred last Wednesday, forced the Somerset-based company to suspend order handling on Thursday, though transport operations remained unaffected. Managing Director Tom Binks confirmed the attack in an email, stating that the firm was implementing workarounds to maintain deliveries while providing regular updates to clients. While existing schedules have largely held, concerns persist among suppliers of perishable goods over potential waste due to delays. This attack follows a recent surge in ransomware incidents targeting the UK retail sector, with Marks & Spencer, Co-op, and Harrods all experiencing disruptions in recent weeks. Phil Pluck, CEO of the Cold Chain Federation, noted a sharp rise in such attacks on food distribution networks, often unreported due to reputational risks. The cold chain sector’s tight timelines and high-volume perishable goods make it a lucrative target for cybercriminals. Security experts warn that supply chain vulnerabilities amplify the impact of such breaches. Richard Orange of Abnormal AI highlighted the risk of follow-on attacks, including vendor email compromise, where attackers impersonate suppliers to steal credentials or redirect payments. Meanwhile, Andy Norton of Armis reported that 41% of retailers have faced increased cyber threats in the past six months, with no signs of slowing. Peter Green Chilled has not yet provided further comment on the incident. A previous reference to Lidl as a client was retracted after the supermarket confirmed it no longer uses the firm’s services.

100
critical Already minimum
MARCALWAISAITOYTHEMORPET-TE1772023906
Incident Details -
Type
ransomware
Motivation
financial gain
Impact
Systems Affected: order processing systems Downtime: order handling suspended on Thursday Operational Impact: disrupted order processing for major UK supermarkets Brand Reputation Impact: potential reputational risk due to unreported incidents in the sector
Response
Incident Response Plan Activated: workarounds implemented to maintain deliveries Containment Measures: order processing suspended Communication Strategy: regular updates provided to clients
Lessons Learned
Supply chain vulnerabilities amplify the impact of cyber breaches; follow-on attacks (e.g., vendor email compromise) are a risk; perishable goods sectors are lucrative targets due to tight timelines.
Recommendations
Enhance cybersecurity measures for supply chain partners; implement network segmentation; adopt adaptive behavioral WAF; use on-demand scrubbing services; monitor for follow-on attacks like vendor email compromise.
Investigation Status
['ongoing']
Stakeholder Advisories
Regular updates provided to clients (supermarkets)
References
Blog URL Source URL
MAY 2025
100
Ransomware
16 May 2025 • Dior and Marks & Spencer: Dior likely hit by ransomware attack
Dior Hit by Suspected Ransomware Attack, Customer Data Exposed

**Dior Hit by Suspected Ransomware Attack, Customer Data Exposed** French luxury fashion house Dior has fallen victim to a suspected ransomware attack, with hackers gaining unauthorized access to internal servers and compromising sensitive customer data. The breach, still under investigation, appears to involve file-encrypting malware, though Dior has not confirmed whether a ransom demand was made. The exposed data includes names, gender details, phone numbers, email and postal addresses, purchase history, and fashion preferences categorized by gender and age. While no financial information such as payment details or employee records was leaked, the stolen data poses risks for targeted phishing attacks, where cybercriminals could use personal details to craft convincing fraudulent messages. Dior has responded by implementing security measures to contain the breach and prevent further spread of the malware. The company’s IT teams are conducting a full investigation and have committed to providing updates as new details emerge. Customers have been advised to monitor their accounts for suspicious activity, as the stolen data may be exploited in phishing schemes over the next 6 to 12 months. The incident follows a recent wave of cyberattacks on major retail brands, including Marks & Spencer, Co-Op, and Harrods, linked to the "Scattered Spider" gang and the DragonForce ransomware group. While Dior has not attributed the attack to a specific threat actor, the breach underscores the growing focus of cybercriminals on retail data, which can be used for fraud, identity theft, or even targeted marketing by third parties. As the investigation continues, the full impact of the breach remains unclear, though the exposure of personal details particularly shopping preferences raises concerns about long-term privacy risks.

100
critical Already minimum
CHRMAR1769504421
Incident Details -
Type
Ransomware
Impact
Data Compromised: Names, gender details, phone numbers, email and postal addresses, purchase history, fashion preferences categorized by gender and age Systems Affected: Internal servers Brand Reputation Impact: Raises concerns about long-term privacy risks Identity Theft Risk: Poses risks for targeted phishing attacks and identity theft Payment Information Risk: No financial information such as payment details was leaked
Response
Incident Response Plan Activated: Yes Containment Measures: Security measures implemented to contain the breach and prevent further spread of the malware Communication Strategy: Customers advised to monitor their accounts for suspicious activity; updates to be provided as new details emerge
Data Breach
Type Of Data Compromised: Customer data Sensitivity Of Data: High (personal details, purchase history, fashion preferences) Data Encryption: File-encrypting malware involved Personally Identifiable Information: Names, gender details, phone numbers, email and postal addresses
Investigation Status
Ongoing
Customer Advisories
Monitor accounts for suspicious activity; stolen data may be exploited in phishing schemes over the next 6 to 12 months
References
Blog URL Source URL
MAY 2025
100
Ransomware
02 May 2025 • Marks & Spencer (M&S)
Ransomware Attack on Marks & Spencer and Harrods by Scattered Spider

Marks & Spencer (M&S), a leading British retail giant, suffered a **ransomware attack** attributed to the hacking group *Scattered Spider* (Octo Tempest) using the *DragonForce* ransomware. The attack disrupted **online orders, contactless payments, click-and-collect services, and gift card processing**, forcing the company to halt all digital sales—a channel generating ~£3.8M in daily revenue. The incident caused **supply chain disruptions**, leading to empty shelves, shortages of key products (e.g., Percy Pigs sweets), and the furlough of 200 warehouse workers. Over **£700M was wiped from M&S’s market value**, with shares dropping 6.5%, while recruitment froze (200+ job listings removed). The attack also triggered a **Metropolitan Police investigation**, though M&S has not confirmed data breaches. Systems remained offline for over a week, with no recovery timeline provided. The **NCSC warned retailers to bolster cybersecurity**, highlighting the attack’s severe operational and financial fallout.

100
critical Already minimum
MAR824090225
Incident Details -
Type
Ransomware Cyberattack
Attack Vector
Phishing SIM Swapping Multi-Factor Authentication (MFA) Fatigue
Motivation
Financial Gain (Ransomware)
Impact
Financial Loss: £700 million (M&S market value wiped; ~£3.8M daily revenue loss from halted online sales) Online order processing Contactless payments Click-and-collect services Warehouse logistics (Castle Donington) Gift card/return processing Job application portal Online Orders: Ongoing since 2024-04-25 (as of 2024-05-02) Contactless Payments: Disrupted since 2024-04-21 Warehouse Operations: Partial shutdown (200 agency workers sent home) Empty shelves in stores (e.g., Percy Pigs sweets shortage) Limited food availability Paused recruitment (200+ job listings removed) Supply chain disruptions Revenue Loss: £3.8M/day (online sales halted; ~1/3 of clothing/home revenue) Customer Complaints: Reported issues with payments, gift cards, and returns Brand Reputation Impact: Significant (6.5% share price drop; publicized operational failures) Payment Information Risk: Potential (contactless payment systems disrupted)
Response
Incident Response Plan Activated: Yes (Systems taken offline as precaution) Third Party Assistance: Yes (Cybersecurity experts engaged by Harrods) Law Enforcement Notified: Yes (Metropolitan Police and NCSC investigating) Online orders suspended Job listings removed Affected systems isolated Initial public disclosure (2024-04-21) Limited updates (last statement on 2024-04-25) Harrods assured customers of normal operations
Data Breach
Data Encryption: Yes (DragonForce ransomware encrypted files)
Regulatory Compliance
Regulatory Notifications: NCSC advised retailers to tighten cybersecurity; consumers urged to check bank activity
Recommendations
Retailers urged to enhance cybersecurity (NCSC advisory) Consumers advised to monitor bank activity and update passwords Multi-Factor Authentication (MFA) hardening recommended
Investigation Status
Ongoing (Metropolitan Police and NCSC investigating as of 2024-04-30)
Customer Advisories
M&S warned of service disruptions; Harrods assured normal operations
Stakeholder Advisories
NCSC urged retailers to tighten cybersecurity; no specific advisories from M&S/Harrods
Initial Access Broker
Phishing SIM Swapping MFA Fatigue Payment systems Warehouse logistics Job application portal
Post Incident Analysis
Phishing vulnerabilities MFA fatigue exploits Lack of segmentation (warehouse/retail systems impacted)
References
Blog URL Source URL
APRIL 2025
100
Cyber Attack
01 Apr 2025 • Marks & Spencer (M&S)
Marks & Spencer (M&S) Cyberattack via Third-Party Vendor (TCS) Leading to £300M Loss and Contract Termination

British retail giant **Marks & Spencer (M&S)** suffered a devastating **cyberattack in April 2025**, orchestrated by the **Scattered Spider** group via **third-party vendor impersonation**, exploiting credentials from **TCS help-desk employees**. The breach forced M&S to **shut down its online shopping platform**, suspend **click-and-collect services**, and disrupt **supply chain operations**, leading to **empty shelves in physical stores**. The financial impact was severe, with **£300 million in lost operating profit** and **£1 billion wiped from market capitalization**. The attack **damaged M&S’s reputation**, eroded customer trust, and prompted the **termination of its long-standing IT support contract with TCS**. The incident underscored vulnerabilities in **outsourced vendor access**, **social engineering risks**, and **supply chain cybersecurity**, causing **operational paralysis** and **competitive disadvantage** as rivals gained market share during the outage.

100
critical Already minimum
MAR3792037102625
Incident Details -
Type
Cyberattack Third-Party Breach Social Engineering Supply Chain Attack
Attack Vector
Sophisticated Impersonation Third-Party Vendor Compromise (TCS Help-Desk Access) Credential Theft
Vulnerability Exploited
Human Trust in Help-Desk Processes Weak Authentication for Third-Party Access Lack of Multi-Factor Authentication (MFA) for Vendor Logins
Motivation
Financial Gain Disruption Data Theft (Presumed)
Impact
Financial Loss: £300 million (estimated lost operating profit) Online Shopping Platform Click-and-Collect Operations Supply Chain Systems Inventory Management Store Stocking Systems Extended suspension of online orders (weeks) Partial halt of click-and-collect services Empty shelves in physical stores Supply chain disruptions Inventory mismanagement Loss of customer trust Conversion Rate Impact: Significant (customers unable to place orders) Revenue Loss: £1 billion+ (market capitalization wiped out) Customer Complaints: Widespread (due to unfulfilled orders and stock shortages) Brand Reputation Impact: Severe (damaged reliability perception, competitive disadvantage)
Response
Incident Response Plan Activated: Yes (though details undisclosed) Suspension of online orders Partial halt of click-and-collect services Isolation of compromised systems (presumed) Contract termination with TCS for help-desk services Review of third-party access controls Enhanced authentication for vendor logins (presumed) Restoration of online shopping platform Rebuilding supply chain operations Customer communication campaigns Public disclosure of incident Statements to MPs (UK Parliament) Investor updates Media responses Enhanced Monitoring: Likely (though not explicitly stated)
Lessons Learned
Vendor access equals attack surface; third-party personnel and processes must be treated as part of the cyber footprint. Social engineering (e.g., impersonation of help-desk staff) remains a critical vulnerability, bypassing technical defenses. Outsourcing does not absolve the client of accountability for cybersecurity, regulatory compliance, or business continuity. Contract renewal timelines should account for cyber risk assessments, especially for high-access vendors. Transparency in incident communication is essential to mitigate reputational damage and stakeholder speculation. Retailers must map 'critical vendors' and integrate them into cybersecurity strategies, not treat them as peripheral suppliers. Disruptions to digital platforms (e.g., online shopping) can have immediate bottom-line impacts, including market share loss to competitors.
Recommendations
Implement stricter authentication for third-party vendor access (e.g., MFA, behavioral biometrics). Conduct regular audits of vendor cybersecurity practices, especially for help-desk and privileged access roles. Develop incident response playbooks specifically for third-party breaches, including clear communication protocols. Integrate vendor risk management into enterprise cybersecurity frameworks, treating critical suppliers as extensions of internal systems. Enhance training for help-desk staff to detect and resist social engineering attacks (e.g., impersonation, phishing). Review outsourcing contracts to include cybersecurity SLAs, liability clauses, and breach response obligations. Adopt zero-trust principles for vendor access, minimizing standing privileges and enforcing least-privilege access. Monitor dark web and underground forums for signs of compromised vendor credentials or targeted attacks.
Investigation Status
Ongoing (as of July 2025; TCS maintains no compromise of its systems)
Customer Advisories
M&S notifications about service disruptions Apologies for order delays and stock shortages
Stakeholder Advisories
M&S updates to investors and MPs TCS communications to clients and media
Initial Access Broker
Entry Point: TCS help-desk staff credentials (impersonation/social engineering) M&S online shopping platform Supply chain systems Inventory management
Post Incident Analysis
Over-reliance on third-party vendor (TCS) for critical help-desk access without sufficient safeguards. Lack of robust authentication (e.g., MFA) for vendor logins, enabling credential theft via impersonation. Inadequate segmentation between M&S systems and TCS help-desk access, allowing lateral movement. Social engineering vulnerabilities in help-desk processes (e.g., scripted password resets). Complex outsourcing ecosystem with elevated third-party access, increasing attack surface. Termination of TCS help-desk contract (though M&S claims unrelated to breach). Likely review of all third-party access controls and authentication mechanisms. Potential adoption of zero-trust architecture for vendor access. Enhanced monitoring of help-desk activities for anomalous behavior. Reevaluation of outsourcing strategies to balance cost savings with cyber risk.
References
Blog URL Source URL
JANUARY 2025
497
Breach
01 Jan 2025 • Harrods and Marks & Spencer: Account Recovery Becomes a Major Source of Workforce Identity Breaches
Account Recovery Workflows Exploited in Identity Breaches Targeting U.K. Retailers

**Cybersecurity Alert: Account Recovery Workflows Become Prime Target for Identity Breaches** In 2025, a wave of cyberattacks targeting major U.K. retailers including Marks & Spencer, Harrods, and the Co-op Group exposed a critical vulnerability in identity security: **account recovery workflows**. Despite robust multi-factor authentication (MFA) and phishing-resistant controls at login, attackers bypassed protections by exploiting password resets, MFA re-enrollment, and help-desk recovery requests through social engineering. The incidents revealed a systemic flaw: **recovery processes are rarely treated as high-risk security events**. Designed for speed and convenience, these workflows rely on outdated assumptions such as trust in human judgment, static knowledge-based questions, and unsecured communication channels that are easily manipulated by modern attackers. AI-driven impersonation, synthesized voices, and stolen credentials now allow threat actors to convincingly mimic legitimate users, making deception nearly undetectable for help-desk staff. While MFA is widely adopted, its effectiveness collapses during recovery. Many organizations require minimal verification to reset MFA, allowing attackers to sidestep authentication entirely. The result? Breaches where MFA was technically "enabled" but functionally useless, as compromised recovery flows undermine downstream security controls. The root issue lies in **identity assurance being treated as disposable**. Onboarding may involve rigorous verification, but recovery often reconstructs trust using weaker signals such as email links or scripted questions rather than referencing the original proofing process. This creates a paradox: **the path to regaining access is easier than the path to maintaining it**. To counter this, experts argue recovery workflows must be **designed for adversarial conditions**. High-risk actions should trigger step-up verification, and self-service resets must preserve identity assurance rather than weaken it. Without these changes, attackers will continue to exploit recovery as the weakest link in identity security bypassing strong authentication without ever directly attacking it.

100
critical -397
HARMAR1773319278
Incident Details -
Type
Identity Breach
Attack Vector
Social Engineering
Vulnerability Exploited
Account recovery workflows (password resets, MFA re-enrollment, help-desk recovery requests)
Impact
Brand Reputation Impact: High Identity Theft Risk: High
Data Breach
Personally Identifiable Information: Likely
Lessons Learned
Recovery workflows must be designed for adversarial conditions. High-risk actions should trigger step-up verification, and self-service resets must preserve identity assurance rather than weaken it. Recovery processes are rarely treated as high-risk security events, creating a systemic flaw in identity security.
Recommendations
1. Treat recovery workflows as high-risk security events. 2. Implement step-up verification for high-risk actions. 3. Preserve identity assurance during self-service resets. 4. Redesign recovery processes to account for modern adversarial tactics like AI-driven impersonation and social engineering.
Post Incident Analysis
Root Causes: 1. Recovery processes rely on outdated assumptions (e.g., trust in human judgment, static knowledge-based questions). 2. Identity assurance is treated as disposable during recovery. 3. MFA effectiveness collapses during recovery due to weak verification requirements.
References
Blog URL Source URL
Ransomware
01 Jan 2025 • Marks & Spencer and Colonial Pipeline: What Is Ransomware, and How Did It Get So Big?
Ransomware as a Persistent Global Threat

**Ransomware Remains a Persistent Global Threat Despite Government Efforts** Since 2021, governments worldwide particularly the U.S. have elevated ransomware to a national security priority, issuing executive orders, convening summits, and imposing indictments and sanctions to combat the growing cyber threat. Yet, four years later, ransomware continues to disrupt critical sectors, including retail, manufacturing, healthcare, and education, with attacks persisting into 2025. The enduring appeal of ransomware for cybercriminals lies in its lucrative and low-risk nature. By deploying malicious software to encrypt victims’ files, attackers demand payment in exchange for decryption keys, often crippling operations. High-profile incidents, such as the 2021 Colonial Pipeline attack that disrupted U.S. fuel supplies, underscore the far-reaching consequences of these breaches. In the same year, British retailer Marks & Spencer suffered a £300 million financial hit from a cyberattack. Despite heightened government action, the ransomware epidemic shows no signs of abating, as cybercriminals exploit vulnerabilities in global digital infrastructure for profit. The threat remains a defining challenge for businesses and organizations worldwide.

100
high -397
MARCOL1772024134
Incident Details -
Type
Ransomware
Vulnerability Exploited
Vulnerabilities in global digital infrastructure
Motivation
Financial profit
Impact
£300 million (Marks & Spencer) Colonial Pipeline disruption Operational Impact: Crippling operations
Data Breach
Data Encryption: Files encrypted
Post Incident Analysis
Root Causes: Exploitation of vulnerabilities in global digital infrastructure
References
Blog URL Source URL
Ransomware
01 Jan 2025 • Asahi, Jaguar Land Rover and Marks & Spencer: Why Ransomware Remains One of Cybersecurity’s Most Persistent Threats
Ransomware Attacks Escalate in 2026: Rising Costs, Evolving Tactics, and Persistent Vulnerabilities

**Ransomware Attacks Escalate in 2026: Rising Costs, Evolving Tactics, and Persistent Vulnerabilities** Ransomware remains one of the most disruptive cybersecurity threats in 2026, with attacks growing in scale, sophistication, and financial impact. The average ransom demand has surged to **$1.3 million**, with over half of payments exceeding **$1 million** a stark increase from the sub-$1,000 demands of a decade ago. Even when victims refuse to pay, the long-term operational and financial damage can be severe, as seen in high-profile incidents affecting **Jaguar Land Rover, Marks & Spencer, and Asahi** in 2025. ### **Why Ransomware Persists and Worsens** Despite being a known threat for years, ransomware attacks are more disruptive than ever due to a combination of **poor cyber hygiene, expanding attack surfaces, and AI-driven tactics**. #### **1. Exploiting Basic Security Failures** Most ransomware attacks succeed by targeting **unpatched vulnerabilities, weak or reused passwords, and missing multi-factor authentication (MFA)**. Excessive user permissions further enable attackers to move laterally across networks undetected. As **Etay Maor of Cato Networks** noted, **"Over 80% of attacks stem from misconfigured or unpatched systems"** highlighting that the root issue lies in preventable security gaps. #### **2. Complex IT Environments Expand the Attack Surface** Modern enterprise networks spanning **cloud infrastructure, AI tools, and remote work systems** have grown increasingly difficult to secure. Misconfigured deployments, such as improperly secured AI chatbots or cloud suites, create new entry points for attackers. Cybercriminals also exploit **legitimate accounts**, making malicious activity harder to detect until it’s too late. #### **3. Social Engineering and AI Amplify Threats** Attackers are increasingly using **social engineering** to bypass security controls. Techniques like **ClickFix**, which tricks users into running malicious scripts via fake error messages, allow cybercriminals to evade defenses with minimal effort. Meanwhile, **AI has lowered the barrier for attackers**, enabling them to: - Generate **customized phishing lures** at scale. - Deploy **deepfake audio/video** to impersonate executives or IT staff. - Automate **ransomware development**, allowing even low-skilled threat actors to launch sophisticated attacks. #### **4. The Ransom Payment Dilemma** The persistence of ransomware is fueled by **victims paying ransoms**, which funds further attacks. As **Gavin Millard of Tenable** warned, **"Paying ransoms only enables attackers to invest in faster, more scalable ransomware operations."** Instead, organizations are urged to focus on **prevention, incident response, and disaster recovery** to break the cycle. ### **The Path Forward: Prevention Over Payment** Experts emphasize that **stronger security fundamentals** such as **patching vulnerabilities, enforcing MFA, and monitoring for unusual account activity** can significantly reduce ransomware risks. However, the challenge remains in **securing board-level investment** for proactive measures, as the cost of prevention is far lower than the fallout of an attack. With ransomware showing no signs of slowing, the battle hinges on **closing security gaps before attackers exploit them** not just reacting after the damage is done.

100
critical -397
MARASAJAG1771331989
Incident Details -
Type
Ransomware
Attack Vector
Unpatched vulnerabilities Weak/reused passwords Missing multi-factor authentication (MFA) Social engineering AI-driven phishing Deepfake impersonation Misconfigured cloud/AI tools
Vulnerability Exploited
Unpatched systems Misconfigured deployments Excessive user permissions Legitimate account compromise
Motivation
Financial gain
Impact
Financial Loss: Average ransom demand of $1.3 million, with over 50% exceeding $1 million Operational Impact: Severe long-term operational and financial damage
Data Breach
Data Encryption: Yes (ransomware-related)
Lessons Learned
Over 80% of attacks stem from misconfigured or unpatched systems. Stronger security fundamentals (patching, MFA, monitoring) can significantly reduce risks. Prevention is more cost-effective than reacting to attacks.
Recommendations
Patch vulnerabilities promptly Enforce multi-factor authentication (MFA) Monitor for unusual account activity Secure board-level investment for proactive measures Avoid paying ransoms to break the cycle
Post Incident Analysis
Poor cyber hygiene Expanding attack surfaces (cloud, AI, remote work) AI-driven tactics (phishing, deepfakes) Social engineering (e.g., ClickFix) Unpatched vulnerabilities and misconfigurations Improve patch management Enforce MFA and least-privilege access Enhance monitoring for lateral movement Secure AI and cloud deployments Invest in employee training for social engineering awareness
References
Blog URL Source URL
DECEMBER 2024
525
Cyber Attack
25 Dec 2024 • SolarWinds, Kaseya, MoveIt Transfer, PowerSchool, DaVita, NASCAR, Marks & Spencer, Caesars Entertainment and Change Healthcare: Ransomware trends, statistics and facts in 2026
Ransomware Trends and High-Profile Attacks (2024-2025)

**Ransomware in 2025–2026: Evolving Threats, Rising Costs, and High-Profile Attacks** Ransomware remains a critical threat to governments, businesses, and critical infrastructure, disrupting healthcare, fuel distribution, retail, and identity security. Financial and operational impacts have intensified, with attackers refining tactics to maximize damage and extortion. ### **Key Ransomware Trends** 1. **Supply Chain Attacks** – Threat actors increasingly target software vendors to compromise multiple downstream victims. Notable incidents include: - **2023 MoveIt Transfer breach** (Clop ransomware gang) - **2021 Kaseya attack** (1,500+ MSP customers affected) - **2020 SolarWinds hack** 2. **Triple Extortion** – Beyond encrypting data and threatening leaks, attackers now demand payment to prevent additional attacks. The **Vice Society** group used this tactic in its 2023 attack on San Francisco’s BART system. Leading ransomware groups like **LockBit 5.0** now use private negotiation portals for targeted extortion. 3. **Ransomware-as-a-Service (RaaS)** – Cybercriminals lease pre-built ransomware tools and infrastructure, lowering the barrier to entry for attacks. 4. **Exploiting Unpatched Systems** – While zero-day vulnerabilities draw attention, most ransomware exploits known flaws in outdated software. 5. **Phishing & AI-Driven Attacks** – Phishing remains a primary infection vector, while generative AI enhances social engineering lures, reconnaissance, and attack automation. ### **Ransomware by the Numbers (2025)** - **44% of breaches** involved ransomware (Verizon 2025 DBIR), a **37% increase** from 2024. - **88% of SMB breaches** included ransomware, compared to **39% in large enterprises**. - **34% rise in attacks** in the first three quarters of 2025 (Total Assure). - **5,010 U.S. incidents** in the first 10 months of 2025 a **50% increase** from 2024 (Cyble). - **85% of attacks go unreported** (BlackFog). - **Median ransom payment**: **$267,500** (Palo Alto Networks 2025). - **Average ransom payment**: **$1 million** (Sophos 2025), down from **$2 million in 2024**. - **Average insurance claim**: **$292,000** (Coalition 2025), a **7% decrease** from 2024. ### **Notable 2024–2025 Ransomware Attacks** - **PowerSchool (Dec. 2024)** – Exposed data of **62M students** and **9.5M teachers** across North America. - **Yale New Haven Health (Mar. 2025)** – Compromised **5.6M patient records**; settled a class-action lawsuit for **$18M**. - **NASCAR (Apr. 2025)** – **Medusa ransomware gang** stole **1TB of data** and demanded **$4M**. - **DaVita (Apr. 2025)** – **2.7M patients’** health data exposed by **Interlock ransomware**. - **Marks & Spencer (May 2025)** – **Pay2Key ransomware** disrupted operations, contributing to a **90% profit drop**. - **Ingram Micro (Jul. 2025)** – **SafePay ransomware** caused service disruptions and revenue losses. - **Change Healthcare (2024)** – Initially reported **100M+ victims**; revised to **193M** by mid-2025. - **LoanDepot (2024)** – Attack disrupted loan services for **16.6M customers**. - **MGM Resorts & Caesars Entertainment (2023)** – High-profile attacks crippled Las Vegas casino operations. ### **Future Ransomware Predictions** - **AI-Powered Automation** – Attacks will become **faster, more persistent**, and harder to detect (Trend Micro). - **Voice-Based Vishing** – **AI-generated calls** will rise as a social engineering tactic (Zscaler). - **Encryption-Free Extortion** – More groups will **skip encryption**, relying solely on data theft threats (SentinelOne). - **GenAI-Enhanced Phishing** – AI will enable **more convincing, large-scale phishing campaigns**. Ransomware shows no signs of slowing, with attackers leveraging AI, supply chain vulnerabilities, and multi-layered extortion to escalate both frequency and impact.

495
critical -30
DAVCAECHAPOWKASFILMARSOLNAS1770898846
Incident Details -
Type
Ransomware
Attack Vector
Supply Chain Attack Phishing Exploiting Unpatched Systems AI-Driven Attacks Vishing
Vulnerability Exploited
Known flaws in outdated software Zero-day vulnerabilities
Motivation
Financial gain Extortion Data theft Operational disruption
Impact
62M students and 9.5M teachers (PowerSchool) 5.6M patient records (Yale New Haven Health) 1TB of data (NASCAR) 2.7M patients' health data (DaVita) 193M victims (Change Healthcare) 16.6M customers (LoanDepot) Healthcare Fuel distribution Retail Identity security Education Casino operations Loan services Disrupted loan services (LoanDepot) Service disruptions and revenue losses (Ingram Micro) Profit drop (Marks & Spencer) 90% profit drop (Marks & Spencer) $18M class-action lawsuit settlement (Yale New Haven Health)
Data Breach
Student records Teacher records Patient health data Corporate data 62M 9.5M 5.6M 1TB 2.7M 193M 16.6M High Yes Yes (in some cases) Yes
Regulatory Compliance
Class-action lawsuit (Yale New Haven Health)
Post Incident Analysis
Unpatched systems Phishing Supply chain vulnerabilities AI-driven attacks
References
Blog URL Source URL
JUNE 2024
498
Cyber Attack
16 Jun 2024 • Marks and Spencer (M&S)
Cybersecurity Breach Involving Marks and Spencer (2024) and Scattered Spider Attacks (2023-2024)

Marks and Spencer (M&S), a high-profile British retailer, suffered a **cybersecurity breach** in early 2024, as referenced in the article. The attack, attributed to an organized group like *Scattered Spider*, likely involved **data compromise and reputational damage**. While specifics of the breach (e.g., type of data stolen, financial loss, or operational disruption) were not detailed, the article highlights the company’s **proactive crisis response**: the CEO issued **timely digital communications** to maintain customer trust and regulatory compliance. The incident underscores the **financial and reputational risks** of modern cyber threats, particularly for large enterprises. M&S’s rapid transparency—addressing stakeholders within days—suggests the breach may have involved **customer data exposure or financial fraud risks**, though no ransomware was explicitly mentioned. The attack aligns with broader trends of **targeted campaigns against retail and critical infrastructure**, emphasizing the need for robust backup systems, incident response plans, and C-suite accountability in cyber resilience.

471
critical -27
MAR5032050110325
Incident Details -
Type
Cyber Attack Data Breach Fraud (Deepfake) Ransomware
Attack Vector
Phishing Deepfake Impersonation Ransomware Social Engineering Exploitation of Human Weaknesses
Vulnerability Exploited
Human Error Lack of Multi-Factor Authentication (MFA) Insufficient Employee Training Weak Access Controls
Motivation
Financial Gain Data Theft Reputation Damage
Impact
Financial Loss: $25M (Hong Kong Deepfake Fraud); Undisclosed for Marks and Spencer Disruption of Critical Applications Potential Loss of Customer Trust Regulatory Scrutiny High (Marks and Spencer CEO initiated timely communications to mitigate damage) Long-term Trust Erosion Risk
Response
Incident Response Plan Activated: Likely (Marks and Spencer CEO initiated communications; incident response retainers mentioned as best practice) Cloud Backup Providers (e.g., Amazon, Google, Microsoft) Specialist Third-Party Backup Services Incident Response Retainers CEO-Led Transparent Communication Cloud Backups for Data Recovery Employee Training on Deepfake/Phishing Prioritization of Critical Applications (e.g., Payroll, Supplier Payments) Third-Party Support for Restoration Timely Digital Communications by CEO (Marks and Spencer) Transparency with Regulators/Investors Early Detection Technologies for Threat Identification
Regulatory Compliance
Regulatory Notifications: Likely (Transparency with regulators emphasized as best practice)
Lessons Learned
Humans remain the weakest link in cybersecurity; advanced training (e.g., deepfake/phishing awareness) is critical. Proactive cyber resilience requires board-level engagement and accountability. Operational continuity relies on robust backups (cloud + third-party) and clear prioritization of critical systems. Transparent, timely communication with stakeholders (customers, investors, regulators) is essential to mitigate reputational damage. Third-party incident response retainers and cybersecurity providers can accelerate recovery and reduce burnout.
Recommendations
Elevate cybersecurity to a board-level imperative with designated expertise (e.g., Virtual CISO). Implement multi-layered defenses: MFA, adaptive behavioral WAFs, network segmentation, and enhanced monitoring. Conduct regular simulations of cyber incidents to test response plans and recovery timelines. Invest in employee training programs that address emerging threats (e.g., deepfakes, social engineering). Establish incident response retainers for immediate access to expert assistance during breaches. Maintain separate third-party backups of cloud data to ensure rapid recovery of critical applications. Develop a communication strategy that prioritizes openness and honesty within 48 hours of an incident.
Customer Advisories
Transparency about breach impact and remediation steps (Marks and Spencer)
Stakeholder Advisories
CEO-led digital communications (Marks and Spencer) Regulatory reporting (emphasized as best practice)
Initial Access Broker
Phishing Emails Deepfake Impersonation (Hong Kong Case) Financial Systems (e.g., CFO impersonation) Customer Data Critical Applications
Post Incident Analysis
Human Error (e.g., falling for deepfake/phishing) Inadequate Training Lack of Proactive Threat Detection Enhanced employee training on emerging threats. Implementation of third-party backup solutions. Board-level cybersecurity accountability. Adoption of early detection technologies.
References
Blog URL Source URL
FEBRUARY 2024
711
Ransomware
01 Feb 2024 • Marks and Spencer
Cyber Attack on Marks and Spencer

A damaging cyber-attack on retailer Marks and Spencer in the UK in April last year has caused a great loss in revenues, with a £300 million ($403 million) operating profit loss, as its online business was taken offline for seven weeks, and is being rebuilt in stages with the process not yet complete 14 months later. The attack was enabled by a DragonForce ransomware group hacker impersonating an employee, reportedly at M&S contractor Tata Consultancy Services, and gaining unauthorized system access via the M&S help desk. Reports indicate the breach began as early as February 2024, when hackers stole the Windows domain’s NTDS.dit file, containing password hashes for domain users. By cracking these hashes, they accessed the network and deployed ransomware to encrypt virtual machines, disrupting services like contactless payments, click-and-collect, and online ordering.

463
critical -248
MAR847071225
Incident Details -
Type
Ransomware
Attack Vector
Phishing, Impersonation
Vulnerability Exploited
Unauthorized system access via help desk
Motivation
Financial gain
Impact
Financial Loss: £300 million ($403 million) Virtual machines Contactless payments Click-and-collect Online ordering Downtime: Seven weeks Operational Impact: Online business taken offline Revenue Loss: £300 million ($403 million)
Lessons Learned
Employees should be trained to recognize and report cyber threats promptly. Organizations should foster a culture of transparent and timely communication of cyber threats.
Recommendations
Implement training and attack simulation training to help employees recognize and respond to cyber threats appropriately.
Initial Access Broker
Entry Point: Help desk
Post Incident Analysis
Root Causes: Employee impersonation and unauthorized system access Corrective Actions: Improve employee training and foster a culture of transparent communication
References
Blog URL Source URL
JUNE 2023
797
Ransomware
16 Jun 2023 • Marks & Spencer (M&S)
Cyber Attack on Co-op Group and Ongoing Ransomware Incident at Marks & Spencer (M&S)

Marks & Spencer (M&S), one of Britain’s most prominent retailers, suffered a **ransomware attack** attributed to the hacking collective *Scattered Spider* using the *DragonForce encryptor*. The attack forced M&S to **shut down critical systems**, including its **website and app**, halting clothing and home orders for **six days** during peak summer demand. Some **food product availability** was also disrupted in stores. The incident caused **operational outages**, financial losses from lost sales, and reputational damage during a high-revenue period. Cybersecurity experts noted the group’s aggressive tactics, including **phishing, MFA bombing, and SIM swapping**, targeting IT help desks. The attack aligns with Scattered Spider’s history of high-profile ransomware campaigns, such as those against *Caesars Entertainment* and *MGM Resorts* in 2023. The **National Cyber Security Centre (NCSC)**, **National Crime Agency (NCA)**, and **Metropolitan Police’s Cyber Crime Unit** are investigating, underscoring the attack’s severity and potential broader economic impact on the UK retail sector.

700
critical -97
MAR1662016090825
Incident Details -
Type
Unauthorized Access Attempt Ransomware Attack
Attack Vector
Phishing MFA Bombing SIM Swapping Exploitation of IT Help Desks
Motivation
Financial Gain (ransomware)
Impact
Back-office systems (Co-op) Call centers (Co-op) Servers (M&S, encrypted) Online ordering systems (M&S) App-based ordering (M&S) Partial (Co-op back-office/call centers) 6+ days (M&S clothing/home orders) Disruption to call centers (Co-op) Paused clothing/home orders (M&S) Limited food product availability (M&S) Potential reputational damage (both companies) Disruption during peak summer demand (M&S)
Response
Yes (Co-op: proactive steps) Yes (M&S: systems taken offline) National Cyber Security Centre (NCSC) National Crime Agency (NCA) Metropolitan Police Cyber Crime Unit Yes (M&S: Metropolitan Police investigating) Likely (Co-op: not explicitly stated) Shut down back-office/call center systems (Co-op) Offline systems (M&S) Working to reduce disruption (Co-op) Public statements (both companies)
Data Breach
Yes (M&S servers encrypted)
Regulatory Compliance
U.S. prosecutors charged 5 alleged Scattered Spider members (November 2023)
Investigation Status
Ongoing (NCSC, NCA, Metropolitan Police involved)
Customer Advisories
Public statements confirming operational status (Co-op) No specific advisories mentioned (M&S)
Initial Access Broker
IT help desks (via social engineering) M&S servers (encrypted)
Post Incident Analysis
Social engineering (MFA bombing, SIM swapping, phishing)
References
Blog URL Source URL
JANUARY 2023
795
Cyber Attack
01 Jan 2023 • HSBC, Nationwide, Barclays, Lloyds, Marks & Spencer and Co-op: Cyber-attack threat keeps me awake at night, bank boss says
UK Banking Sector Faces Relentless Cyber Threats and IT Failures

**UK Banking Sector Faces Relentless Cyber Threats as IT Failures Disrupt Services** The UK’s financial sector is grappling with escalating cybersecurity risks and frequent IT outages, with bank executives warning of the severe consequences for market stability and public trust. Speaking before the Commons Treasury Committee, HSBC UK CEO Ian Stuart emphasized that cybersecurity is "top of the agenda" for his group, describing the financial burden of defending against attacks as "enormous." HSBC alone is investing hundreds of millions of pounds to bolster its IT systems, reflecting a broader industry trend. Cybersecurity experts, including Prof Oli Buckley of Loughborough University, described attacks on financial institutions as "relentless" and "increasingly sophisticated," with criminals monetizing breaches more efficiently than ever. Lisa Forte of Red Goat Cyber Security noted that Stuart’s concerns underscored a critical vulnerability: businesses should now assume an attack is a matter of *when*, not *if*. The impact of IT failures has been stark. Between January 2023 and February 2024, nine major UK banks and building societies including Barclays, Lloyds, Nationwide, and HSBC experienced **158 IT outages**, totaling **803 hours (33 days)** of disruption. In January, a Barclays outage on payday left customers unable to access funds, while February saw further outages affecting **1.2 million people**. Though Barclays UK CEO Vim Maru apologized for the disruptions, he confirmed no evidence of a cyberattack or malicious intent. Beyond financial institutions, retailers like Co-op and Marks & Spencer have also faced severe disruptions from cyber incidents, highlighting the cross-sector nature of the threat. Bank executives, including Stuart, admitted the risks keep them "awake at night," with one describing the constant barrage of attacks as a daily reality. The Treasury Committee’s inquiry into banking resilience underscores the urgency of addressing these vulnerabilities, as failures ripple beyond individual accounts eroding confidence in the financial system itself.

765
critical -30
THEBARHSBLLONATMAR1774391436
Incident Details -
Type
IT outage Cyber threat
Motivation
Financial gain Disruption
Impact
Systems Affected: Banking services, customer access to funds Downtime: 803 hours (33 days) Operational Impact: Service disruptions, inability to access funds Brand Reputation Impact: Erosion of public trust in financial institutions
Response
Remediation Measures: Investing hundreds of millions of pounds to bolster IT systems Communication Strategy: Public apologies from executives (e.g., Barclays UK CEO Vim Maru)
Regulatory Compliance
Regulatory Notifications: Treasury Committee inquiry into banking resilience
Lessons Learned
Businesses should assume a cyberattack is a matter of *when*, not *if*. The financial sector must prioritize cybersecurity investments and resilience planning.
Recommendations
Increase investment in IT systems, enhance monitoring and response capabilities, and prepare for inevitable cyber threats.
Post Incident Analysis
Root Causes: Escalating cyber threats, IT system vulnerabilities, and increasing sophistication of attackers Corrective Actions: Bolstering IT systems, increasing cybersecurity investments, and improving incident response planning
References
Blog URL Source URL

Frequently Asked Questions

According to Rankiteo, the current A.I.-based Cyber Score for Marks and Spencer is 100, which corresponds to a Critical rating.

According to Rankiteo, the A.I. Rankiteo Cyber Score for March 2026 was 100.

According to Rankiteo, the A.I. Rankiteo Cyber Score for February 2026 was 100.

According to Rankiteo, the A.I. Rankiteo Cyber Score for January 2026 was 100.

According to Rankiteo, the A.I. Rankiteo Cyber Score for December 2025 was 100.

According to Rankiteo, the A.I. Rankiteo Cyber Score for November 2025 was 100.

According to Rankiteo, the A.I. Rankiteo Cyber Score for October 2025 was 100.

According to Rankiteo, the A.I. Rankiteo Cyber Score for September 2025 was 100.

According to Rankiteo, the A.I. Rankiteo Cyber Score for August 2025 was 100.

According to Rankiteo, the A.I. Rankiteo Cyber Score for July 2025 was 100.

According to Rankiteo, the A.I. Rankiteo Cyber Score for June 2025 was 100.

According to Rankiteo, the A.I. Rankiteo Cyber Score for May 2025 was 100.

Over the past 12 months, the average per-incident point impact on Marks and Spencer’s A.I Rankiteo Cyber Score has been 0 points.

You can access Marks and Spencer’s cyber incident details on Rankiteo by visiting the following link: https://www.rankiteo.com/company/marks-and-spencer.

You can find the summary of the A.I Rankiteo Risk Scoring methodology on Rankiteo by visiting the following link: Rankiteo Algorithm.

You can view Marks and Spencer’s profile page on Rankiteo by visiting the following link: https://www.rankiteo.com/company/marks-and-spencer.

With scores of 18.5/20 from OpenAI ChatGPT, 20/20 from Mistral AI, and 17/20 from Claude AI, the A.I. Rankiteo Risk Scoring methodology is validated as a market leader.