Almost daily, my phone pings with messages from hackers of various stripes, each keen to share their exploits. As a seasoned cyber security correspondent, I have engaged with many over the years, though most conversations remain confidential. Recently, however, a message sparked my attention. “Hey. This is Joe Tidy from the BBC reporting on this Co-op news, correct?” the anonymous hackers wrote on Telegram. Intrigued, I initiated a dialogue that revealed the extent of their claims regarding recent cyber attacks on Marks & Spencer (M&S) and the Co-op.
Over the course of a five-hour exchange, it became evident that these hackers were not only articulate masters of English but also likely involved in the attacks that significantly disrupted both retailers. They provided evidence suggesting the theft of vast amounts of private customer and employee information. I reviewed a sample of this data before securely deleting it, understanding the gravity of its potential ramifications.
Shoppers have faced widespread inconveniences, with empty shelves becoming a common sight in Co-op stores across the UK. Initially, the Co-op downplayed the incident as manageable; however, after my inquiry, the company admitted to stakeholders that a substantial data breach indeed occurred. The hackers, frustrated by the Co-op's resistance to their ransom demands, later sent me an aggressive letter detailing their grievances with the retailer's response and claiming that their efforts had narrowly averted a more catastrophic scenario.
The group responsible for these breaches is known as DragonForce. They function as a cyber criminal service on the darknet, where they offer ransomware-as-a-service. This business model allows them to retain a cut from the ransoms paid by affiliates seeking to utilise their malicious software for extortion. DragonForce's emergence follows a notable shift in the cybercriminal landscape; with previous ransomware services like LockBit facing crackdowns, new players have vied for dominance. This has led to an arms race of sorts, with groups like DragonForce aggressively promoting enhanced services such as 24/7 customer support and advanced negotiation tools for ransomware claims.
The ramifications of these attacks have been significant for both retailers. M&S's share price plummeted by 16%, erasing approximately £1.3 billion from its market value, while analysts predicted that the overall financial impact could exceed £125 million if disruptions continued. Cyber insurance may provide some respite, with M&S expected to claim up to £100 million to offset losses. Nevertheless, persistent operational challenges remain. Online services have been hampered, with customers grappling with limited access, prompting the company to pause its loyalty offers and reset customer passwords as a precautionary measure against further breaches.
As the situation unfolded, it was reported that DragonForce had used social engineering tactics to breach internal systems, impersonating employees to deceive IT help desks into resetting passwords. This method exemplifies the tactics cybercriminals employ, often exploiting basic vulnerabilities rather than complex technological exploits. Such incidents underscore the ongoing need for organisations to refine their security protocols.
This latest wave of cyber incidents strikes a chord with the broader theme of increasing cyberattacks targeting retailers in the UK. While M&S attempts to salvage operations, the Co-op recently announced that its systems have returned to normal following a similar breach, highlighting a pervasive trend that poses grave risks to businesses across the retail sector.
The evolving landscape of cyber threats reveals an urgent need for enhanced strategies in both prevention and response. As the reality of these digital attacks becomes more pronounced, it is imperative that organisations not only bolster their defences but also embrace a collaborative approach to mitigate risks and protect vital consumer information.
Reference Map
- Paragraphs 1, 2, 3, 4
- Paragraphs 5, 6
- Paragraph 7
- Paragraphs 8, 9
- Paragraph 10
- Paragraph 11
- Paragraph 12
Source: Noah Wire Services