What are the M&S, Co-op, and Harrods cyber attacks all about
This is a guest post by James Bore from Bores consultancy. He explains what the attack are, why they happened, the impact on customers and what should be done to prevent such attacks in the future.
What M&S, Co-op, and Harrods cyber attacks reveal
In early 2025, three of our biggest retailers in the UK – M&S, Co-op, and Harrods – were hit by a run of cyber attacks. Online orders were unavailable, stores couldn’t take payments, refunds were unavailable. Behind the scenes, logistics went down leading to empty shelves. The cause of everything – data stolen and systems locked down.
These attacks weren’t unstoppable. The methods used are easily preventable, and have been well-known in the computer security world for over fifty years. That’s what makes this so concerning.
What Happened?
A criminal group known as Scattered Spider (among other names), who have previously attacked US casinos, targeted the retailers using what was described variously as a “sophisticated technique” or an “advanced attack.”
They called the help desk and tricked staff into resetting employee passwords.
From there they broke into company systems using those credentials, stole passwords for more powerful accounts, and used ransomware tools from another group called DragonForce to lock up the systems.
M&S were the worst hit. Their online ordering systems were still offline weeks later, and the estimated cost is just shy of £4 million a day in lost revenue and recovery costs. Today (21/05/25) it said that disruption will last until July and cost £300 million.
This Keeps Happening, Why?
Many businesses are still relying on outdated systems and processes that were never designed with security in mind.
- Help desks are able to reset passwords and provide them over the phone
- Password systems rely on a single point of failure
- Company networks are wide open once someone gets inside
These are known problems. They’ve been flagged in security reports for years. Companies keep putting off real fixes in favour of quick patches and expensive, heavily-marketed, flashy tools.
Human-First
These attacks don’t just affect company profits. They hit customers first.
People rely on online services for deliveries, groceries, appointments – especially as all the alternatives have been removed over time. When these systems go down they lose time, access, and in some cases personal data. At Co-op, personal data was leaked. At M&S, essential services stopped working. Trust takes a hit – briefly, before we all forget.
Inside the cyber security world, we’re often sympathetic when these attacks happen. Rightly so – frontline IT staff and support teams didn’t cause these issues, but will be suffering for them as they try to repair damage.
But sympathy for individuals shouldn’t excuse lack of accountability at the top.
These aren’t small businesses strapped for resources. These are billion-pound businesses with the resources to protect their systems and put better secure processes in place. They had the tools. They will have had people internally raising the risks. They still left the door wide open.
It’s not enough to say “not if, but when.” These methods we’ve seen before. We will see them again – unless we demand better from companies and they deliver.
We need companies to:
- Build systems that assume attackers will get in, and contain the damage when they do
- Stop relying on processes that give too much trust, like phone-based password resets
- Segment networks, so one breach doesn’t take down the whole business, and prepare and test plans for when things fail
- Treat customer trust like the critical asset it is, not something which can be fixed with an apology and waiting for the news cycle to roll over
Co-op and Harrods avoided the same level of impact because they took action quickly, even if that action was to cut off their systems entirely for a while. Whether they’d have been as fast to respond if M&S hadn’t been affected first we’ll never know.
These weren’t sophisticated attacks. They were basic weaknesses, repeated again. Customers deserve better. So do the people on the front lines, trying to clean up the mess.
If you are a customer what should you do?
If you’ve shopped with one of those affected, keep an extra eye out for suspicious emails, texts, or login attempts – especially pretending to be from the company. Change your password if you use it anywhere else, and turn on two-factor authentication. Beyond that, speak up. Ask companies what they’re doing to protect your data.
Better security shouldn’t be on you – it should be the bare minimum they offer in return for trusting them with your data.
@thecomplainingcow How did the cyber attack happen? What security is in place? What happens to our data? #marksandspencer #CyberAttack #CyberSecurity #Data #DataProtection #DataSecurity #Loyalty
More on cyber attacks
What is Software Fragility and Why Should You Care?
