- Retail and Cyber Risks: What We Can Learn from the Latest Breach

Cameron Lewis I 13th May 2025

Recent headlines have been dominated by reports of cyber-attacks targeting major retailers, with M&S and Co-op being the latest to face security breaches. These targeted, sophisticated attacks have disrupted operations, compromised customer data, and raised concerns about the retail sector's vulnerability.

So what happened?

The attackers used social engineering techniques to impersonate employees and deceive the IT help desk. This allowed them to reset passwords and gain access to the internal system. It is currently being reported that a ransomware-as-a-service operation known as DragonForce is involved. There are still many unknowns regarding who is using DragonForce, but it’s claimed that it’s a group of hackers called Scattered Spider.

There will be more information shared on this once an investigation by the NCSC has been completed.

What is the impact?

M&S and The Co-op have experienced a loss of personal data. Both attacks have caused the organisations to shut down their IT with M&S having to stop all online transactions for clothing and home orders. It is currently estimated that the breach is costing M&S around £15 million per week.  

Both retailers have engaged cybersecurity experts and are collaborating with the UK's National Cyber Security Centre (NCSC) and the National Crime Agency to investigate the breaches. The NCSC has issued warnings to other retailers about the rise in social engineering attacks and recommended reviewing help desk protocols to prevent similar incidents.

Implications

The attacks outline the growing threats and implications of cyberattacks. These attacks will inevitably call for enhanced security measures across multiple sectors. As investigations continue, the retail industry faces increased pressure to fortify defences against an evolving landscape of cyber threats.

Preventing targeted attacks can be difficult for any organisation. However, there are steps all companies can take to reduce the likelihood. This includes following internationally recognised standards such as ISO27001 or implementing the NCSC recommended controls under the Cyber Essentials scheme.

For more information on these, check out our articles below:

Cyber Essentials - https://www.3ct.co.uk/post/how-to-obtain-cyber-essentials-certification

ISO27001 - https://www.3ct.co.uk/post/why-do-i-need-iso27001  

‍