Terrifying message sent by ‘Chinese hackers' to M&S boss after crippling cyber attack on British retailer is revealed

Scottish Sun

14 hours ago

The blackmail message is believed to have included a racist term
RANSOM DEMAND Terrifying message sent by 'Chinese hackers' to M&S boss after crippling cyber attack on British retailer is revealed
Click to share on X/Twitter (Opens in new window)
Click to share on Facebook (Opens in new window)
'CHINESE hackers' allegedly sent a terrifying message to the boss of Marks & Spencer following a crippling cyber-attack on the British retailer.
Fraudsters, believed to be from the hacking group DragonForce, are said to have emailed the company's chief executive Stuart Machin and seven other key executives.
Sign up for Scottish Sun
newsletter
Sign up
2
High street retailer Marks & Spencer was hit by a cyber attack over the Easter holiday
Credit: Alamy
2
M&S boss Stuart Machin, pictured, along with seven other company executives were emailed by the hackers, believed to be DragonForce
Credit: PA
The message, written in broken English, was sent on April 23, indicated that M&S was hacked by the ransomware group, although the retailer has not acknowledged this.
'We have marched the ways from China all the way to the UK and have mercilessly raped your company and encrypted all the servers,' the hackers wrote, according to the BBC.
'The dragon wants to speak to you so please head over to [our darknet website].'
The link to the darknet shared in the email led to a portal for victims of DragonForce to negotiate a ransom fee.
The hackers added: 'Let's get the party started. Message us, we will make this fast and easy for us.'
DragonForce's attack during the Easter holiday has been hugely damaging for one of Britain's best-known retailer and is thought to have cost the firm an estimated £300million.
After six weeks on from the attack, the retailer is still unable to process online orders.
The email was sent to Mr Machin along with seven other top executives, according to the corporation.
A racist term is also said to have been included in the blackmail message and also ended with an image of a fire-breathing dragon.
Along with installing ransomware in order to cripple M&S's IT system the hackers are also believed to have stolen private data from millions of customers.
The £3.50 M&S buy that'll make your whole house smell like a 'boujee candle'
Three weeks on from the attack, M&S informed customers that contact details and dates of birth from some shoppers had been obtained by a suspected cyber cartel.
M&S also admitted other personal details, including customers' order histories, had also been pilfered by online criminals.
Bosses though have stressed that no data relating to shoppers' payment, card details or account passwords had been obtained.
It is unclear how many customers have been affected by the data breach.
According to the company's full-year results, it had 9.4million active online customers in the year up to March 30.
The email apparently sent by DragonForce is thought to have bene sent using the account of an employee from IT company Tata Consultancy Services (TCS), which has provided IT services to the retailer for more than a decade.
The Indian IT worker, who is based in London, had an M&S email address but is paid employee of TCS.
Timeline of the attack Saturday, April 19: Initial reports emerge on social media of problems with contactless payments and click-and-collect services at M&S stores across the UK. Customers experience difficulties collecting online purchases and returning items due to system issues.
Initial reports emerge on social media of problems with contactless payments and click-and-collect services at M&S stores across the UK. Customers experience difficulties collecting online purchases and returning items due to system issues. Monday, April 21: Problems with contactless payments and click-and-collect persist. M&S officially acknowledges the "cyber incident" in a statement to the London Stock Exchange. CEO Stuart Machin apologises for the disruption and confirms "minor, temporary changes" to store operations. M&S notifies the National Cyber Security Centre (NCSC) and the Information Commissioner's Office (ICO) and engages external cybersecurity experts.
Problems with contactless payments and click-and-collect persist. M&S officially acknowledges the "cyber incident" in a statement to the London Stock Exchange. CEO Stuart Machin apologises for the disruption and confirms "minor, temporary changes" to store operations. M&S notifies the National Cyber Security Centre (NCSC) and the Information Commissioner's Office (ICO) and engages external cybersecurity experts. Tuesday, April 22: Disruptions continue. M&S takes further systems offline as part of "proactive management".
Disruptions continue. M&S takes further systems offline as part of "proactive management". Wednesday, April 23: Despite earlier claims of customer-facing systems returning to normal, M&S continues to adjust operations to maintain security. Contactless payments are initially restored, but other services, including click-and-collect, remain affected.
Despite earlier claims of customer-facing systems returning to normal, M&S continues to adjust operations to maintain security. Contactless payments are initially restored, but other services, including click-and-collect, remain affected. Thursday, April 24: Contactless payments and click-and-collect services are still unavailable. Reports surface suggesting the attackers possibly gained access to data in February.
Contactless payments and click-and-collect services are still unavailable. Reports surface suggesting the attackers possibly gained access to data in February. Friday, April 25: M&S suspends all online and app orders in the UK and Ireland for clothing and food, although customers can still browse products. This decision leads to a 5% drop in M&S's share price.
M&S suspends all online and app orders in the UK and Ireland for clothing and food, although customers can still browse products. This decision leads to a 5% drop in M&S's share price. Monday, April 28: M&S is still unable to process online orders. Around 200 agency workers at the main distribution centre are told to stay home.
M&S is still unable to process online orders. Around 200 agency workers at the main distribution centre are told to stay home. Tuesday, April 29: Information suggests that the hacker group Scattered Spider is likely behind the attack. Shoppers spot empty shelves in selected stores.
Information suggests that the hacker group Scattered Spider is likely behind the attack. Shoppers spot empty shelves in selected stores. Tuesday, May 13: M&S revealed that some customer information has been stolen.
M&S revealed that some customer information has been stolen. Wednesday, May 21: The retailer said disruption from the attack is expected to continue through to July.
The retailer said disruption from the attack is expected to continue through to July.
It's thought the worker was among the victims hacked.
The company had previously said it is investigating if it was a gateway for the cyber attack.
It has since informed the BBC the email was not sent from its system and had nothing to do with the security breach.
M&S has declined to comment on the latest revelations.
A spokesperson for the company told The Sun Online: 'We cannot comment on details of or speculation on the cyber incident, and we have been advised not to.'