M&S and Co-op: What we know weeks after cyber attacks
On Friday, 25 April, M&S halted online orders after it reported being a victim of a cyber attack.
Just under a week later, the Co-op revealed it was also the victim of an attempted hack and that several of its services had been impacted. Luxury retailer Harrods was also affected.
Now, more than two weeks on from the original hack, M&S still cannot process sales online, and Co-op has only just managed to get its shelves stocked.
They are also declining to offer any timeline on when things may return to normal.
Cabinet Office minister Pat McFadden said the wave of attacks on UK businesses should be a 'wake-up' call for the industry.
What have we learned since the attack?
Although M&S and Co-op have not released much information about the attacks, it is becoming clear that it was not a small incident.
It has been estimated that each day their website is offline, M&S loses £3.5 million. Half a billion pounds has also been wiped off its share price.
Co-op also said the data of a significant number of their customers had been stolen, and they had issues with taking card payments.
ITV News learned that in the wake of the attack, loyalty cards, handheld scanners and apps used to report security incidents in M&S stores were all impacted. Numerous products have been taken offline as a result of the hack. / Credit: PA
Reports emerged claiming that a hacking group known as Scattered Spider was behind the attack.
The group is notorious in the online criminal world for targeting large companies and breaching their data.
It is believed the attackers used a piece of ransomware called Dragonforce to cripple the system.
Cyber security expert Graham Cluley told ITV News: 'Attacks involving the DragonForce ransomware usually start with exploitation of known vulnerabilities – often involving corporate systems that have not been kept up-to-date with the latest security patches, or because they have not been configured properly.'
Tech specialist website BleepingComputer reported that hackers tricked Co-op and Marks & Spencer IT help desk workers into gaining access to the companies' systems.
It is believed they used a method known as sim-swapping to steal a person's phone number and other key pieces of data in order to effectively impersonate someone and give businesses access to their account.
Scattered Spider has used this tactic in the past.
It is believed that once they had enough access, they used M&S's Active Directory, a Microsoft product that connects internal networks and stores information.
Cyber security expert, Professor Alan Woodward, told ITV News: 'Active Directory is a Microsoft product, which allows you to log in once and access all the systems.
'There's a suggestion that they managed to get in and get one of the files out of there, which contains passwords, etc. Empty shelves inside a Marks & Spencer days after the attack. / Credit: PA
'They probably wouldn't have been able to get the passwords out of the file, but if they could get in that far, then they could probably do something to mess up the network.'
Industry expert Sam Kirkman from cybersecurity firm NetSPI said the hackers had likely gained access to M&S's core systems which means they can 'cripple multiple areas of a business at once, maximising their impact and making it very difficult to recover without extensive rebuilding of key IT systems – which takes time.'
It is believed that one of the reasons both M&S and Co-op are taking so long to get their services back to normal is that they have not paid the ransom demanded by the hackers, which is the advice of the UK government.
What are the businesses saying?
Not much. When ITV News contacted M&S, it said it had no new update about when all of its services would return to normal.
The last update from M&S was 10 days ago when their CEO, Stuart Machin, said in a statement they were working 'day and night' to restore their services.
This is despite the fact that it has been almost three weeks since they disabled online orders on their website.
If you try and order an item of clothing from M&S's website, it just says: 'We have paused online orders. Products remain available to browse online and stores are open.'
Co-op told ITV News all of their stores were receiving deliveries as of Monday morning.
But they did say: 'Some of our stores might not have all their usual products available and we are sorry if this is the case for our members' and customers in their local store. We are working around the clock to reduce disruption and are pleased to have resumed delivery of stock to our shelves.'
Local media and social posts online have shown both Co-op and M&S shelves empty with apology notices saying they had issues with stock delivery.
Get all the latest news from around the country Follow STV News
Scan the QR code on your mobile device for all the latest news from around the country
Hashtags
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Leader Live
23 minutes ago
- Leader Live
Judge denies justice department request to unseal Epstein grand jury transcripts
The ruling on Wednesday by Judge Richard Berman in Manhattan came after the judge presiding over the case against British socialite Ghislaine Maxwell, Epstein's former girlfriend, also turned down the government's request. Maxwell is serving a 20-year prison sentence after her conviction on sex trafficking charges for helping Epstein sexually abuse girls and young women. Epstein died in jail awaiting trial. A US justice department spokesperson declined to comment. Judge Berman said the information contained in the Epstein grand jury transcripts 'pales in comparison to the Epstein investigative information and materials in the hands of the Department of Justice.' According to his ruling, no victims gave evidence before the Epstein grand jury. The only witness, the judge wrote, was an FBI agent 'who had no direct knowledge of the facts of the case and whose testimony was mostly hearsay'. The agent gave evidence over two days, on June 18 and July 2 2019. The rest of the grand jury presentation consisted of a PowerPoint slideshow shown during the June 18 session and a call log shown during the July 2 session, which ended with grand jurors voting to indict Epstein. Both of those will also remain sealed, Judge Berman ruled. Maxwell's case has been the subject of heightened public focus since an outcry over the justice department's statement last month saying that it would not be releasing any additional documents from the Epstein sex trafficking investigation. The decision infuriated online sleuths, conspiracy theorists and elements of US President Donald Trump's base who had hoped to see proof of a government cover-up. Since then, Trump administration officials have tried to cast themselves as promoting transparency in the case, including by requesting from courts the unsealing of grand jury transcripts. 'The government is the logical party to make comprehensive disclosure to the public of the Epstein file,' Judge Berman wrote in an apparent reference to the justice department's refusal to release additional records on its own while simultaneously moving to unseal grand jury transcripts. 'By comparison,' he added, 'the instant grand jury motion appears to be a 'diversion' from the breadth and scope of the Epstein files in the government's possession. The grand jury testimony is merely a hearsay snippet of Jeffrey Epstein's alleged conduct.' Meanwhile, Maxwell was interviewed at a Florida courthouse weeks ago by US deputy attorney general Todd Blanche, and the house oversight committee had also said that it wanted to speak with Maxwell. Her lawyers said they would be open to an interview but only if the panel were to ensure immunity from prosecution. In a letter Maxwell's lawyers, representative James Comer, the committee chairman, wrote that the committee was willing to delay the deposition until after the resolution of Maxwell's appeal to the Supreme Court. That appeal is expected to be resolved in late September. Mr Comer wrote that while Maxwell's testimony was 'vital' to the Republican-led investigation into Epstein, the committee would not provide immunity or any questions in advance of her testimony, as was requested by her team.
South Wales Guardian
23 minutes ago
- South Wales Guardian
Judge denies justice department request to unseal Epstein grand jury transcripts
The ruling on Wednesday by Judge Richard Berman in Manhattan came after the judge presiding over the case against British socialite Ghislaine Maxwell, Epstein's former girlfriend, also turned down the government's request. Maxwell is serving a 20-year prison sentence after her conviction on sex trafficking charges for helping Epstein sexually abuse girls and young women. Epstein died in jail awaiting trial. A US justice department spokesperson declined to comment. Judge Berman said the information contained in the Epstein grand jury transcripts 'pales in comparison to the Epstein investigative information and materials in the hands of the Department of Justice.' According to his ruling, no victims gave evidence before the Epstein grand jury. The only witness, the judge wrote, was an FBI agent 'who had no direct knowledge of the facts of the case and whose testimony was mostly hearsay'. The agent gave evidence over two days, on June 18 and July 2 2019. The rest of the grand jury presentation consisted of a PowerPoint slideshow shown during the June 18 session and a call log shown during the July 2 session, which ended with grand jurors voting to indict Epstein. Both of those will also remain sealed, Judge Berman ruled. Maxwell's case has been the subject of heightened public focus since an outcry over the justice department's statement last month saying that it would not be releasing any additional documents from the Epstein sex trafficking investigation. The decision infuriated online sleuths, conspiracy theorists and elements of US President Donald Trump's base who had hoped to see proof of a government cover-up. Since then, Trump administration officials have tried to cast themselves as promoting transparency in the case, including by requesting from courts the unsealing of grand jury transcripts. 'The government is the logical party to make comprehensive disclosure to the public of the Epstein file,' Judge Berman wrote in an apparent reference to the justice department's refusal to release additional records on its own while simultaneously moving to unseal grand jury transcripts. 'By comparison,' he added, 'the instant grand jury motion appears to be a 'diversion' from the breadth and scope of the Epstein files in the government's possession. The grand jury testimony is merely a hearsay snippet of Jeffrey Epstein's alleged conduct.' Meanwhile, Maxwell was interviewed at a Florida courthouse weeks ago by US deputy attorney general Todd Blanche, and the house oversight committee had also said that it wanted to speak with Maxwell. Her lawyers said they would be open to an interview but only if the panel were to ensure immunity from prosecution. In a letter Maxwell's lawyers, representative James Comer, the committee chairman, wrote that the committee was willing to delay the deposition until after the resolution of Maxwell's appeal to the Supreme Court. That appeal is expected to be resolved in late September. Mr Comer wrote that while Maxwell's testimony was 'vital' to the Republican-led investigation into Epstein, the committee would not provide immunity or any questions in advance of her testimony, as was requested by her team.
Daily Mirror
24 minutes ago
- Daily Mirror
Unshaven Huw Edwards spotted still wearing wedding ring despite 'marriage breakdown' reports
Huw Edwards, former BBC news presenter, is still wearing his wedding ring although his wife Vicky reportedly launched divorce proceedings in October 2024 Former BBC newsreader Huw Edwards has been spotted in public with his wedding ring still firmly on his finger, despite reports that his marriage to wife Vicky Flind has broken down. The disgraced broadcaster, 64, was photographed in Swansea earlier this week, marking his birthday with miniature bottles of prosecco. He was wearing his wedding band in the images. Edwards and Vicky Flind were married for three decades and share five children. However, it was reported in October 2024 that Flind had filed for divorce. Reports at the time suggested he had moved out of the family home and that their long marriage had come to an end. However, his wedding band was clearly visible in the photos taken in Wales, where he could be seen clutching three small bottles of fizz and a baseball cap while heading to his car. The sighting comes during his ongoing public fall from grace. Although he was once one of the most respected faces on British television, Edwards has largely vanished from the public eye since pleading guilty to three counts of making indecent images of children. He was sentenced in February to six months' imprisonment, suspended for two years, after admitting to possessing seven Category A images – the most serious – alongside dozens of Category B and C images. Though Edwards avoided an immediate prison term, his sentencing made clear how close he came to jail. The court handed down a suspended sentence after hearing of his major depressive disorder and the considerable risks he would face in custody. Alongside the suspended sentence, Edwards was ordered to complete a 40-day Sex Offender Treatment Programme and attend 25 rehabilitation sessions to address both his mental health and alcohol use. He also lost his career over the incident, and Edwards resigned from the BBC in April 2024, a year after he last appeared on air to announce the death of Queen Elizabeth II. Since then, the Welsh journalist has kept an extremely low profile, only being seen a handful of times. Earlier this year, he was photographed vaping in public, with onlookers describing him as "a shadow of his former, super-confident self". Flind, who is a TV producer, has not publicly commented on the current state of their relationship. She was previously praised for standing by Edwards during his mental health struggles and his wife's comment about his mental health problems at the time.
