Scotland Yard detectives are investigating a significant cyber attack that has crippled Marks & Spencer (M&S), with the IT disruption believed to have been orchestrated by a teenage hacker group known as Scattered Spider. The Metropolitan Police’s cyber crime unit has been engaged in the probe, working alongside the National Cyber Security Centre and the Information Commissioner’s Office (ICO) to understand and counter the attack.
This cyber group, reportedly comprising around 1,000 mainly British and American youths and young men, has garnered a notorious reputation globally for targeting major brands with sophisticated attacks. Cyber security experts have highlighted the group’s dangerous level of expertise, combining technical hacking skills with social engineering tactics, such as phishing scams designed to manipulate company staff and IT help desks into providing access to corporate systems.
According to reports from the trade website Bleeping Computer, Scattered Spider is believed to have infiltrated M&S’s servers as early as February and then executed the attack around the Easter period. The fallout has forced M&S to pause its click and collect service, significantly disrupting its online ordering capability. The retailer’s home and clothing segment, which typically generates approximately £11 million in daily sales, with a third coming from online sales, faces substantial financial losses estimated at nearly £3.7 million per day while the online platform remains offline.
M&S has reportedly sought assistance from cyber security experts, including Microsoft, CrowdStrike, and Fenix24, in its efforts to restore services and secure its systems. Despite the disruption, the company has refrained from commenting on the specifics of the attack, including the identity of the hackers or whether any ransom demands have been met. Industry insiders note that such criminal groups often demand ransoms of up to £10 million in exchange for restoring full access to affected companies' IT systems.
The hacker collective, also known by names such as Scatter Swine and Muddled Libra, has a history of targeting numerous firms since May 2022. Last year, US authorities charged five alleged members related to attacks on at least a dozen companies, including the high-profile case of casino operator Caesars Entertainment, which was forced to pay hackers £12 million in 2023 following a similar cyber attack.
Among the suspects is Tyler Buchanan, a 22-year-old from Dundee who was extradited from Spain to California on charges linked to casino cyber attacks. Previously, a 17-year-old from Walsall was arrested in connection with global investigations into Scattered Spider activities. Recently, a leading member of the group, Noah Urban, pleaded guilty to multiple online fraud offences in a Florida court, facing up to 60 years in prison and an order to repay more than £10 million.
Business leaders have expressed concern about the broad-reaching threat posed by cyber criminals. George Weston, chairman of Associated British Foods, which owns Primark and Twinings tea, commented on the situation in an interview with the Daily Mail, saying, “All of business, certainly us, have been very aware of cyber risk for some time... We look at what’s happened [at M&S] with sadness. Whatever we can do to help, we would do – but it’s a threat to all of us.”
Meanwhile, the operational impact on M&S remains significant, with stores experiencing empty shelves and the online service suspended for the fifth day. The ongoing investigation and recovery efforts continue, with no arrests made at this stage, as authorities seek to bring those responsible to justice and restore normal service to one of the UK’s leading retailers.
Source: Noah Wire Services