M&S cyber attack linked to notorious hacking group

Daily Mail​

30-04-2025

Published: | Updated:
Scotland Yard detectives are probing the devastating IT meltdown at M&S thought to be caused by teenage hackers. A shadowy group operating under the name Scattered Spider was yesterday said to be behind the attack, which has crippled the retailer for more than a week.
But the Mail can now reveal the Metropolitan Police's cyber crime unit has been called in to investigate the crisis. The collective, thought to be made up of 1,000 mainly British and American youths and young men, has already gained global notoriety for a slew of attacks on major brands, with a cyber security expert warning it poses a 'sophisticated threat'.
Such criminal outfits typically demand up to £10million in ransom for returning full access to firms, say industry sources. No arrests had been made last night, a Met spokesman confirmed, adding: 'Detectives from the Met's cyber crime unit are investigating. Inquiries continue.'
Detectives have been working alongside the National Cyber Security Centre and data watchdog the Information Commissioner's Office (ICO). Marks & Spencer would not share details last night nor speculate on the culprit or confirm whether it has paid a ransom. In hacks such as this, criminals typically infiltrate an IT system, freeze it and demand payment from companies. Trade website Bleeping Computer said 'multiple sources' pointed to Scattered Spider having gained access to M&S's servers as far back as February before putting their plan into action over Easter.
As a result M&S paused its click and collect service, where customers order items online for collection from a shop. These orders are still being hit. Bosses at the retailer are said to have asked for help from experts at Microsoft as well as cyber security professionals CrowdStrike and Fenix24. Julius Cerniauskas, of web experts Oxylabs, said: 'Their goal is simple: the greater the disruption, the greater the pressure on the firm to pay the ransom.' Cyber expert Ed Williams, of Trustwave, said these attacks require 'calculated' criminals who understand 'both the technical and human weaknesses to exploit within large organisations'.
And Nathaniel Jones, of cyber firm Darktrace, warned Scattered Spider poses a 'sophisticated threat' to big companies, adding: 'Their approach is dangerous. They are thought to be native English speakers who don't just exploit technical vulnerabilities but manipulate people, especially IT help desks.' Previously the group, which the FBI has said poses a threat akin to hacking operations in China and Russia, has carried out 'phishing attacks' – sending fake texts to staff mobiles asking them to click on a link that gives the hackers access to work systems.
US casino firm Caesars Entertainment was brought to its knees in September 2023 and ultimately forced to pay hackers £12million to restore its network. The gang – which is also known by other names including Scatter Swine and Muddled Libra – has been linked to raids on firms since May 2022.
Last year US authorities charged five alleged members with targeting at least 12 firms. The suspects included 22-year-old Tyler Buchanan, from Dundee, who was extradited to California from Spain last week on charges related to attacks on casino operators including Caesars. Last July a 17-year-old boy from Walsall was arrested as part of a different global probe into the gang. And earlier this month a leading member pleaded guilty to a string of online fraud offences in a Florida court. Noah Urban faces up to 60 years in prison and must pay back more than £10million.
George Weston, chairman of Primark and Twinings tea owner Associated British Foods, said: 'All of business, certainly us, have been very aware of cyber risk for some time... We look at what's happened [at M&S] with sadness. Whatever we can do to help, we would do – but it's a threat to all of us.' In a further blow for M&S, shop shelves were pictured empty yesterday while online orders were suspended for a fifth day. Its home and clothing business takes around £11million in sales a day – with a third of this from online. That means M&S could lose close to £3.7million every day the website is down.
Want more stories like this from the Daily Mail? Hit the follow button above for more of the news you need.