Marks & Spencer, the Co-op, and Harrods. All three are esteemed retailers, and all three have recently become victims of a cyber attack.
M&S has had its retail operations severely curbed, with online ordering going offline for – at the time of writing – the best part of a month. Its Sparks rewards programme has also been impacted.
M&S CEO Stuart Machin expects a £300m hit to profits, and the firm’s share value has lost around £750m. Machin may lose £1m in bonuses.
As the Financial Times reported, Machin said the attack was a consequence of “human error” rather than weakness in its IT systems or cyber defences. He added that “threat actors only have to be lucky once, and we didn’t leave the door open, so this wasn’t anything to do with under-investment.”
It appears that, in the case of Marks & Spencer, hackers employed social engineering tactics via a third-party supplier to trick IT staff into changing passwords and resetting authentication processes, thereby gaining access.
As for the Co-op, it took down some of its IT systems to cope with the attack, while Harrods did not take its website offline and told customers to “not do anything differently at this point”.
The National Crime Agency suspects that a cyber-criminal collective, Scattered Spider, is behind the attacks. It used ransomware known as DragonForce. The group has been linked to high-profile attacks, including two US casinos in 2023 and Transport for London in 2024.
Cyber-security firm Red Goat reckons that “calling up IT help desks is a tactic that Scattered Spider seems to favour, and they use social engineering techniques to manipulate someone into doing something like clicking on a link or resetting someone’s account to a password they can use.” It’s this that seems to be leading investigators to the group.
The National Cyber Security Centre (NCSC) is working with firms and organisations to better understand the nature of the attacks so that it can offer better advice on protection.
The Centre’s CEO, Richard Horne, has urged companies “to follow the advice on the NCSC website to ensure they have appropriate measures in place to help prevent attacks and respond and recover effectively.”
In particular, it has recommended that corporate security teams use multifactor authentication, check for risky logins, and review help desk login procedures.
But why is it that some firms survive such attacks while others struggle? In many cases, it’s down not only to technical processes put in place to thwart attackers but also a combination of good luck and the goal of the attacker.
In the case of Marks & Spencer, it looks like the attacker wanted to cause material harm to the company. In contrast, the attack on the Co-op was an attempt to harvest personal data. Harrods somehow got off lightly, given that the attacker appears to be the same group behind the attack on Marks & Spencer.
It’s easy to be wise after the event and lock the stable door after the horse has bolted. Similarly, the firms that tend to be best protected are those that have survived and learned from a cyber attack.
But some have not been so fortunate. Code Spaces, a cloud-based hosting service, closed within 12 hours of an attack in 2014 which deleted all hosted data and backups. And Travelex, the currency retailer, fell into administration in January 2020 following an attack the previous New Year’s Eve.
Of course, there are lessons for every business to learn – why did Harrods seem to get off scot-free while M&S was pummelled? Did it have better security and cyber controls? Had it better procedures for coping with cyber incidents? Was the company better practised in isolating systems and halting the attack? And has Marks & Spencer suffered more because Harrods was simply better at PR?
It’s unlikely that we’ll ever know the full extent of the attack or the response. But one thing is certain: Businesses of all sizes and in all sectors need to plan for an attack – small firms in particular, as they’ll likely have fewer reserves to keep the plates spinning should the worst happen and will, in all probability, have invested less proportionately in cyber defences.