M&S chairman accuses rivals of covering up cyber attacks

Telegraph

4 days ago

The chairman of Marks & Spencer has accused rivals of hiding cyber attacks as he called for mandatory reporting in the wake of the retailer's devastating breach.
Archie Norman said he was aware of two other large attacks in recent weeks that had not been reported to authorities.
M&S was sent reeling by a cyber attack in April linked to the hacking group Scattered Spider. The hack took its online operations offline for weeks and continues to affect parts of the business including its click-and-collect services.
The attack, which Mr Norman said was down to a 'sophisticated impersonation', will cost the company £300m in gross profits.
'We do think that mandatory reporting is a very interesting idea,' he told MPs on the business and trade committee.
'A number of serious cyber attacks never get reported to the NCSC [National Cyber Security Centre]. In fact, we have reason to believe there have been two major cyber attacks of large British companies in the last four months which have gone unreported.
'I'm not on the boards of those companies, so I don't know – but that's what we have been advised. I don't think it would be regulatory overkill for companies of a certain size [that] you are required within a time limit to report those to the NCSC and that would enhance the central intelligence around this.'
M&S executives said the threat from cyber attacks was severe enough that companies should be prepared to shut down their systems and run on pen and paper in the event of a hack.
Nick Folland, M&S's general counsel, said: 'One of the things that we would say to others is make sure you can run your business on pen and paper because that's what you need to be able to do for a period of time while all your systems are down, because you take them down yourself for protection.'
M&S, the Co-op and Harrods have been hit by cyber attacks linked to Scattered Spider in recent weeks, a group believed to be made up of teenagers in the US and UK.
Mr Norman refused to say whether M&S had paid a ransom to the hackers to regain access to its systems. 'We don't think it's in the public interest to go into that, partly because it is a matter of law enforcement,' he said.
Executives from the Co-op, asked later in the evidence session, confirmed that they had not paid a ransom.
Mr Norman said M&S had doubled its cyber insurance cover last year, meaning it would recover a substantial portion of its £300m in lost profits but that it might take 18 months.
He said the company had shared details of the attack with the FBI, adding that British cyber security authorities were 'limited in their resources'.
'If you want a growth economy, you need a cyber-resilient economy,' he added.
Mr Norman said that in retrospect the company should have upgraded IT systems earlier but that in recent years the company had been recovering from a legacy of outdated infrastructure.
'Anybody who suffered an event like ours, it would be foolish to say there's not a thousand things you would like to have done differently,' he said.