Scotland Yard has launched an investigation into the cyber attack that has severely disrupted operations at Marks & Spencer (M&S), causing empty shelves in stores and a significant decline in the retailer's market value. The Metropolitan Police confirmed they were called to address the incident on Wednesday, 23 April. Detectives from the Met’s Cyber Crime Unit are actively investigating the case, which remains ongoing.
The retailer is also collaborating with experts from the National Crime Agency (NCA) and the National Cyber Security Centre (NCSC). According to the NCA, these organisations are working closely to better understand the nature of the cyber incident and offer support to M&S.
M&S first disclosed the attack on Tuesday, acknowledging “pockets of limited availability” of certain items in some stores. The disruption followed the retailer’s precautionary decision to take some systems temporarily offline to mitigate the effects of the breach. Since the cyber attack began over a week ago, M&S has faced complications with its contactless payments and click-and-collect services, which led to a temporary suspension of orders on its website and app from last Friday. These services have remained offline as the company works to resolve the issue.
A spokesperson for the Metropolitan Police said: “We were called on Wednesday, 23 April regarding a cyber-incident at Marks & Spencer. Detectives from the Met’s Cyber Crime Unit are investigating. Enquiries continue.”
Professor Alan Woodward, a cyber security expert at the University of Surrey and former adviser to Europol, spoke to The Independent on Tuesday, providing insights into the prolonged nature of the disruption. Prof Woodward explained that M&S’s cautious approach in investigating the incident likely explains the extended downtime: “They are turning over every rock and making sure there’s nobody still in there. Because one of the worst things is if a hacker has got in, let the ransomware go, and they can persist on the network, then you might clear it – you might get out of it – but they’ll just pop back up again.”
Reports have linked the cyber attack to a hacking group known as Scattered Spider, reputedly involving British and American teenagers. Tech news outlet Bleeping Computer was among the first to associate this group with a potential ransomware attack against the retailer. Furthermore, investigators reportedly believe that the attackers utilised a hacking tool from DragonForce, a group describing itself as a “ransomware cartel,” to execute the breach, according to The Telegraph.
M&S has not confirmed specific technical details of the attack but continues to work intensively with law enforcement and cybersecurity experts to restore normal operations. The incident remains a significant challenge for one of the UK’s leading retail brands, impacting customer services and the company’s financial standing in the market.
Source: Noah Wire Services