What we know as M&S reopens website after major cyber attack

Yahoo

18 hours ago

Marks & Spencer has reopened its website to customers after it was forced to halt internet orders in April following a damaging cyber attack.
The retail giant said shoppers are now able to buy a selection of its best-selling fashion ranges and new products for home delivery to England, Scotland and Wales.
In a statement published on social media, M&S managing director of clothing, home and beauty John Lyttle said: 'More of our fashion, home and beauty products will be added every day, and we will resume deliveries to Northern Ireland and Click and Collect in the coming weeks.
'Thank you sincerely for your support and for shopping with us.'
On 25 April, after the Easter weekend, M&S reported that it had become the victim of a cyber attack and suspended its online orders.
Initially, the incident affected the contactless payment and click and collect orders, before M&S paused online orders through its app and website.
The cyber attack even led to empty shelves in some M&S stores, as the company said there were "pockets of limited availability" in some of its shops.
M&S revealed last month that the hack was caused by 'human error', and would cost it around £300 million. Chief executive Stuart Machin said on reporting annual figures in May that hackers gained access to the company's IT systems through a third party.
He said at the time: 'We didn't leave the door open, this wasn't anything to do with under-investment. Everyone is vulnerable. For us, we were unlucky on this particular day through some human error.'
M&S also revealed that some personal data had been stolen.
It said: "As part of our proactive management of the incident, we have taken steps to protect our systems and engaged leading cyber security experts. We have also reported the incident to relevant government authorities and law enforcement, who we continue to work closely with.
According to M&S, the data taken could include customers' names, date of birth, phone numbers, home addresses, email addresses and online order history.
However, it said the breach did not include card payment details or account passwords.
M&S said: "Importantly, the data does not include useable payment or card details, which we do not hold on our systems, and it does not include any account passwords. There is no evidence that this data has been shared."
The firm would not say how many customers were affected by the attack, but that it is writing to everyone they have an email for.
M&S had 9.4 million active online customers in the year to 30 March, according to its last full-year results.
Following the breach, anyone with an M&S account were prompted to change their password after they logged in to the app or online.
M&S said: "We have said to customers that there is no need to take any action. For extra peace of mind, they will be prompted to reset their password the next time they visit or log onto their M&S account and we have shared information on how to stay safe online."
The hackers behind the M&S attack used the DragonForce cybercrime service, whose malicious software and website is available on the darknet to carry out attacks and what's sometimes called "double extortion".
This means they steal a copy of their victims' data and also scramble it to make it unusable.
The double extortion occurs when they then effectively ask for a ransom for both unscrambling the stolen data and for also deleting their copy of it so they won't sell it online.
DragonForce's darknet website does not currently have any entries about M&S, the BBC reported.
It is not known who is using DragonForce to attack M&S – it was also reportedly used to target the Co-op and Harrods recently, but a group of hackers called Scattered Spider have been linked to the breach.
At the beginning of this month, the Information Commissioner's Office said it was looking into the attack, as well as a similar major incident involving the Co-op.
Luxury department store Harrods also confirmed this month it had been affected by an attempted hack and had temporarily restricted internet access across its sites as a precautionary measure.
The National Crime Agency has said it is investigating the attacks individually but is 'mindful they may be linked'.
Experts told Yahoo News UK that cyber attacks on supermarkets are unlikely to stop.
'This sort of thing is likely to happen more often," said Paul Bischoff, consumer privacy advocate at UK software company Comparitech.
"Ransomware is a proven way for cybercriminals to make money, and until that's no longer true, we'll continue to see ransomware attacks."
Cody Barrow, chief executive of software firm EclecticIQ, said: "It highlights an alarming trend: attackers are becoming increasingly opportunistic, exploiting weaknesses across complex, highly interconnected supply chains."