Major M&S boss reveals criminal gang behind crippling cyber attack

Scottish Sun

a day ago

The cybergang is believed to have been founded in 2023
Click to share on X/Twitter (Opens in new window)
Click to share on Facebook (Opens in new window)
MARKS & Spencer has revealed that hacker group "DragonForce" was behind the cyberattack that shut down its online shopping for six weeks.
Chairman Archie Norman told UK lawmakers the attack crippled M&S's automated warehouse in Castle Donington, which is set to be back online imminently.
Sign up for Scottish Sun
newsletter
Sign up
1
Norman said it might take up to 18 months to get the insurance payout for the attack
Credit: Getty
The breach disrupted operations in April and May, forcing the retailer to scramble to restore its systems.
The hack saw click and collect services across UK stores go down, as well as customer information stolen.
The group originally suspected to be behind the cyber attack was "Scattered Spider" - a notorious cyber criminal-collective.
However, it's now confirmed that the attack was carried out by DragonForce.
DragonForce creates ransomware that locks up a victim's files and rents it out to other criminals.
A group of young, English-speaking hackers is thought to be using DragonForce's tools to attack companies.
These hackers steal data and demand a ransom to unlock the files and prevent the stolen information from being leaked.
The attack on M&S began on Saturday, April 19, with customers unable to collect purchases or return items.
On April 21, M&S acknowledged the attack, apologised for the inconvenience, and engaged cyber security experts while notifying the National Cyber Security Centre (NCSC) and the Information Commissioner's Office (ICO).
Despite M&S' efforts to restore systems, disruptions continued throughout the week, forcing the retailer to make operational adjustments, including suspending online and app orders on Friday, April 24.
NSA warns cellphone users to change 'dangerous' message setting now or risk device being 'cloned' – it takes 3 clicks
This decision led to a 5% drop in the company's share price.
Shoppers reported empty shelves in some stores with staple items including bananas, fish, and the iconic Colin the Caterpillar cakes hard find in some shops.
On May 13, M&S confirmed that some customer information had been stolen in the attack.
On Wednesday, May 21, M&S said that disruption from the attack is expected to continue through July.
Timeline of cyber attack Saturday, April 19: Initial reports emerge on social media of problems with contactless payments and click-and-collect services at M&S stores across the UK. Customers experience difficulties collecting online purchases and returning items due to system issues.
Initial reports emerge on social media of problems with contactless payments and click-and-collect services at M&S stores across the UK. Customers experience difficulties collecting online purchases and returning items due to system issues. Monday, April 21: Problems with contactless payments and click-and-collect persist. M&S officially acknowledges the "cyber incident" in a statement to the London Stock Exchange. CEO Stuart Machin apologises for the disruption and confirms "minor, temporary changes" to store operations. M&S notifies the National Cyber Security Centre (NCSC) and the Information Commissioner's Office (ICO) and engages external cybersecurity experts.
Problems with contactless payments and click-and-collect persist. M&S officially acknowledges the "cyber incident" in a statement to the London Stock Exchange. CEO Stuart Machin apologises for the disruption and confirms "minor, temporary changes" to store operations. M&S notifies the National Cyber Security Centre (NCSC) and the Information Commissioner's Office (ICO) and engages external cybersecurity experts. Tuesday, April 22: Disruptions continue. M&S takes further systems offline as part of "proactive management".
Disruptions continue. M&S takes further systems offline as part of "proactive management". Wednesday, April 23: Despite earlier claims of customer-facing systems returning to normal, M&S continues to adjust operations to maintain security. Contactless payments are initially restored, but other services, including click-and-collect, remain affected.
Despite earlier claims of customer-facing systems returning to normal, M&S continues to adjust operations to maintain security. Contactless payments are initially restored, but other services, including click-and-collect, remain affected. Thursday, April 24: Contactless payments and click-and-collect services are still unavailable. Reports surface suggesting the attackers possibly gained access to data in February.
Contactless payments and click-and-collect services are still unavailable. Reports surface suggesting the attackers possibly gained access to data in February. Friday, April 25: M&S suspends all online and app orders in the UK and Ireland for clothing and food, although customers can still browse products. This decision leads to a 5% drop in M&S's share price.
M&S suspends all online and app orders in the UK and Ireland for clothing and food, although customers can still browse products. This decision leads to a 5% drop in M&S's share price. Monday, April 28: M&S is still unable to process online orders. Around 200 agency workers at the main distribution centre are told to stay home.
M&S is still unable to process online orders. Around 200 agency workers at the main distribution centre are told to stay home. Tuesday, April 29: Information suggests that the hacker group Scattered Spider is likely behind the attack. Shoppers spot empty shelves in selected stores.
Information suggests that the hacker group Scattered Spider is likely behind the attack. Shoppers spot empty shelves in selected stores. Tuesday, May 13: M&S revealed that some customer information has been stolen.
M&S revealed that some customer information has been stolen. Wednesday, May 21: The retailer said disruption from the attack is expected to continue through to July.
Click and collect, next day delivery and UK nominated day delivery for fashion items are still unavailable with services set to be restored "as soon as possible".
However, the retailer reintroduced a selection of third-party brands to its website last week, including Adidas, Columbia, and Lilybod.
Meanwhile, the high street giant has reduced its standard home delivery wait times from 10 days to five for customers in England, Scotland and Wales.
The M&S website also says home delivery in Northern Ireland will resume "in the coming weeks".
M&S is now strengthening its cybersecurity measures to prevent future attacks as it works to fully recover from the disruption.