Don't pay hackers: Cyber Security chief's warning after major retail attacks

ITV News

07-05-2025

The head of the UK's cyber security agency, which is helping Marks & Spence r, the Co-op and Harrods manage the fallout from three suspected ransomware attacks, has warned that all companies should resist the financial demands hackers make.
'Our advice is organisations shouldn't pay ransoms,' Dr Richard Horne, CEO of the National Cyber Security Centre, part of GCHQ, said.
'If [companies] pay because they hope the ransom attackers won't publish information, well, they need to know that all they've got is a criminal's word for it. And if they pay to recover their systems, well, they should have recovery plans in place so they can recover their systems anyway.'
A ransomware attack occurs when hackers infect a company's computer systems with malicious software that encrypts files and locks users out, effectively paralysing parts of the IT network.
Attackers then demand payment, usually in cryptocurrency, in exchange for a decryption key or to prevent the publication of stolen data.
Horne explained, in the NCSC's experience, hackers tend to hold onto the data they steal and often don't unlock systems even when payments are made.
Two weeks ago, on April 22, Marks & Spencer first admitted that it was dealing with the fallout from a cyber attack.
Last week, the Co-op and Harrods revealed their systems had also been targeted by hackers.
Since then, several independent cybersecurity experts have said the evidence suggests the hacks were carried out by Scattered Spider, a ransomware group.
Yesterday, the technology news website Bleeping Computer reported that the hackers gained access to both the Co-op's and M&S's networks by impersonating employees, contacting the retailers' IT helpdesks and tricking helpdesk staff into resetting passwords.
Richard Horne refused to be drawn on who the NCSC believes the hackers are, how they got in, what they managed to access or whether the attacks are linked.
'Until we have the facts, you just don't know,' he told ITV News.
'One of the challenges with cyber attacks is you are in a fog for a period, and picking your way through that fog — getting the facts, understanding exactly what the attackers did, what data they accessed, what data they didn't access, what systems they got to — that does take time.
"We've seen many organisations take weeks, if not months, to get real clarity on what happened.'
In the past, some ransomware gangs have been linked to foreign governments. The global WannaCry ransomware attack in 2017, which forced the NHS to cancel thousands of appointments and operations, was later linked to North Korea by Microsoft.
The NCSC is not ruling out the influence of foreign governments in these incidents.
Horne added that there's 'no evidence of deeply personal information being taken' in any of the three hacks, and he advised customers of M&S, the Co-op and Harrods not to change passwords as a precaution.
The NCSC publishes advice and guidance on the steps organisations should take to prevent attacks and to respond effectively in the event of a successful hack.
Horne wouldn't say if the three retailers had followed that advice or if the attacks were preventable.
He did say that, across society, everyone is underestimating the scale of the risk cyber criminals pose.
'All organisations need to see this as a wake-up call — to understand what their exposure is to cyber attacks, to ensure they've got the right defences in place, and to make sure they've got a plan to be able to continue operations and recover should they be hit by a cyber attack,' he said.