Marks & Spencer Faces Major Cyberattack Disrupting Online Services
Marks & Spencer and Harrods have been targeted by cyberattacks, significantly disrupting operations and raising concerns across the retail sector.
Subscribe to unlock this story
We really don't like cutting you off, but you've reached your monthly limit. At just $5/month, subscriptions are how we keep this project going. Start your free 7-day trial today!
Get StartedHave an account? Sign in
Overview
Marks & Spencer is grappling with a severe cyberattack by a group named Scattered Spider, halting online orders and causing substantial losses. Harrods has also reported a cyber incident amid rising cybersecurity threats in retail. The UK National Cyber Security Centre is involved in investigations, urging retailers to bolster defenses against growing cyber threats.
Report issue
Read both sides in 5 minutes each day
Analysis
- Marks & Spencer and Harrods have recently suffered significant cyberattacks, with investigations underway and operational disruptions affecting customer services and stock availability.
- The hacker group Scattered Spider is suspected to be involved, highlighting a concerning trend of increasing cyber threats targeting major retailers.
- Experts are calling for enhanced cybersecurity measures across the retail sector as these incidents demonstrate a growing boldness among cybercriminals.
Articles (3)
FAQ
The cyberattack on Marks & Spencer has been attributed to a hacking collective known as Scattered Spider (**also referred to as UNC3944**), which includes English-speaking hackers primarily based in the UK and US[1][3][4].
The **DragonForce encryptor** is the ransomware tool used by Scattered Spider to lock Marks & Spencer's critical systems and demand payment, contributing to an estimated £500 million drop in market value and operational disruptions[4][5].
Marks & Spencer suspended online sales for **five days** following the ransomware attack, resulting in daily losses averaging £3.8 million ($5.1 million) during the disruption[4][5].
Attackers gained initial access through **Active Directory credential theft**, exploiting vulnerabilities to infiltrate M&S's systems as early as February 2025 before deploying ransomware[4][5].
**Harrods** and **Co-op** have also reported recent cyber incidents, indicating a broader cybersecurity crisis in the UK retail sector[5].
History
- This story does not have any previous versions.