Pierluigi Paganini@Security Affairs
//
Victoria's Secret has shut down its website and disabled some in-store services following a cybersecurity incident. The lingerie retailer's online presence was temporarily halted during the Memorial Day Weekend, a peak holiday shopping period. While physical Victoria's Secret and PINK retail stores remain open, the company has taken steps to address the issue and has engaged third-party experts to restore operations. They do not know when operations will be back up and running.
The incident has disrupted online returns, fulfillment of recent orders, and the redemption of direct mail coupons, prompting the company to extend its U.S. return window by 30 days and extend expired coupon redemption windows. Victoria's Secret customers have expressed frustration with the lack of updates and difficulty contacting representatives through chat, email, or phone. They are working to fulfill orders placed before Monday.
The cyberattack on Victoria's Secret is part of a disturbing trend targeting global retailers, with recent breaches at Dior, Adidas, Harrods, Co-op, and Marks & Spencer. Experts such as Darren Guccione, CEO of Keeper Security, warn that this may signal that cybercrime groups are now actively targeting U.S. companies. Security professionals urge retailers to adopt proactive strategies like Privileged Access Management (PAM) and multi-factor authentication, while consumers are advised to use password managers and dark web monitoring services to protect themselves.
Recommended read:
References :
- cyberinsider.com: Victoria’s Secret Shuts Down Website and Store Systems Following Cyberattack
- securityaffairs.com: Victoria’s Secret ‘s website offline following a cyberattack
- Davey Winder: Victoria’s Secret Lingerie Site Down — Security Incident Cited
- SecureWorld News: Victoria's Secret Latest Victim of Cyberattacks
- Graham Cluley: Victoria's Secret has reportedly suffered a major IT outage due to a cybersecurity "incident."
- www.cybersecuritydive.com: Victoria's Secret shuts down website in response to security incident
- techcrunch.com: Victoria’s Secret hit by outages as it battles security incident
- thecyberexpress.com: Victoria’s Secret Website Down After Security Incident
- The Record: The Victoria's Secret site now features a brief message to customers explaining that the retailer is "taking steps to address a security incident."
Dhara Shrivastava@cysecurity.news
//
British retailer giant Marks & Spencer (M&S) is facing a major financial impact following a recent cyberattack, with potential profit losses estimated at £300 million, equivalent to $402 million. The attack has caused widespread operational and sales disruptions, particularly affecting the company's online retail systems. According to a recent filing with the London Stock Exchange, M&S anticipates these disruptions to continue until at least July, impacting its fiscal year 2025/26 profits.
The cyberattack has significantly impacted M&S’s online sales channels, forcing the company to temporarily halt online shopping in its Fashion, Home & Beauty divisions. This downtime has led to substantial revenue loss, despite the resilience of its physical stores. The company has also faced increased logistics and waste management costs as it reverted to manual processes. CEO Stuart Machin acknowledged the challenging situation but expressed confidence in the company's recovery, emphasizing a focus on restoring systems and accelerating technical transformation.
M&S is actively implementing strategies to mitigate the financial repercussions, including cost management, insurance claims, and strategic trading actions. The retailer is reportedly preparing to claim up to £100 million from its cyber insurance policy to offset some of the losses. The company views this crisis as an opportunity to expedite its technical transformation, although specific details of this transformation have not yet been disclosed. The costs related to the attack itself and technical recovery are expected to be communicated at a later date as an adjustment item.
Recommended read:
References :
- The Register - Security: Marks & Spencer warns of a £300M dent in profits from cyberattack
- The DefendOps Diaries: Marks & Spencer Faces Major Financial Impact from Cyberattack
- BleepingComputer: Marks & Spencer faces $402 million profit hit after cyberattack
- ComputerWeekly.com: M&S cyber attack disruption likely to last until July
- BleepingComputer: British retailer giant Marks & Spencer (M&S) is bracing for a potential profit hit of up to £300 million £300 million ($402 million) following a recent cyberattack that led to widespread operational and sales disruptions.
- techxplore.com: Marks & Spencer cyberattack: How can retailers regain customers' trust after a hack?
- www.cybersecuritydive.com: M&S warns April cyberattack will cut $400 million from profits
- The Hacker News: Russian cyber threat actors have been attributed to a state-sponsored campaign targeting Western logistics entities and technology companies since 2022.
- DataBreaches.Net: Western intelligence agencies unite to expose Russian hacking campaign against logistics and tech firms
- techxplore.com: Cyberattack costs UK retailer Marks & Spencer £300 mn
- www.cysecurity.news: Scattered Spider Cyberattack Cripples M&S, Co-op: DragonForce Ransomware Causes Weeks-Long Disruption
- Tech Monitor: Marks & Spencer faces £300m impact on profit from cyberattack
- www.bleepingcomputer.com: Marks & Spencer faces $402 million profit hit after cyberattack
- socprime.com: A joint advisory from cybersecurity and intelligence agencies across North America, Europe, and Australia confirms a two-year-long cyberespionage campaign by russian GRU Unit 26165 (APT28, Forest Blizzard, Fancy Bear).
- www.esecurityplanet.com: Russian military hackers are targeting Western firms aiding Ukraine, using cyberespionage to infiltrate logistics networks and spy on arms shipments.
@cyble.com
//
Following a series of cyberattacks targeting major UK retailers including Marks & Spencer, Co-op, and Harrods, the National Cyber Security Centre (NCSC) has issued an urgent alert, urging organizations to bolster their defenses. The attacks, which involved ransomware and data theft, have caused significant operational disruptions and data breaches, highlighting the increasing risk faced by the retail sector. The NCSC anticipates that similar attacks are likely to escalate and emphasizes that preparation is key to ensuring business continuity and minimizing financial losses.
The NCSC advises businesses to take immediate and proactive measures to mitigate risks. A key recommendation is to isolate and contain threats quickly by severing internet connectivity immediately to prevent malware from spreading further across networks. It's equally important to ensure that backup servers remain isolated and unaffected by the attack, so they can be used for disaster recovery. The security agency is also calling on firms to review their password reset policies, and in particular how IT help desks authenticate workers when they make a reset request, especially in the case of senior employees with escalated privileges.
To enhance cyber resilience, the NCSC stresses the importance of implementing multi-factor authentication (MFA) across the board. The agency also warns organizations to be constantly on the lookout for ‘risky logins’ within Microsoft Entra ID Protection, where sign-in attempts are flagged as potentially compromised due to suspicious activity or unusual behaviour. The Information Commissioner's Office (ICO) has similar advice warning organizations to make sure that accounts are protected by a strong password, and that passwords aren't being reused across multiple accounts. While attacks against UK retailers have rocked the industry in recent weeks, the NCSC's guidance aims to help businesses avoid falling victim to similar incidents.
Recommended read:
References :
- DataBreaches.Net: Marks & Spencer breach linked to Scattered Spider ransomware attack
- Davey Winder: Harrods is the latest major U.K. retailer to confirm a cyberattack as M&S continues to struggle with ransomware strike fallout.
- securityaffairs.com: Luxury department store Harrods suffered a cyberattack
- The Register - Security: British govt agents step in as Harrods becomes third mega retailer under cyberattack
- www.itpro.com: Harrods hit by cyber attack as UK retailers battle threats
- Graham Cluley: Uh-oh. Marks & Spencer, Co-op, and now Harrods is the latest high profile UK retailer to be hit by what is (most likely) a attack. No organisation is 100% safe.
- techcrunch.com: UK retail giant Co-op warns of disruption as it battles cyberattack
- Bloomberg Technology: DragonForce hacking gang takes credit for UK retail attacks
- NCSC News Feed: NCSC statement: Incident impacting retailers
- Resources-2: Retail Under Fire: Inside the DragonForce Ransomware Attacks on Industry Giants
- Zack Whittaker: Bloomberg reporting that DragonForce ransomware gang "and its partners" were behind cyberattacks targeting U.K. retail giants Marks & Spencer, Co-op and Harrods. The gang also claimed to have stolen customer data.
- doublepulsar.com: DragonForce Ransomware Cartel attacks on UK high street retailers: walking in the front door
- Metacurity: Harrods becomes the third top UK retailer to fend off a cyberattack
- hackread.com: UK Retailer Harrods Hit by Cyber Attack After M&S, Co-op
- NPR Topics: Technology: Harrods, the iconic luxury department store, has become the latest British retailer to fall victim to a cyberattack.
- bsky.app: Uh-oh. Marks & Spencer, Co-op, and now Harrods is the latest high profile UK retailer to be hit by what is (most likely) a #ransomware attack.
- www.bbc.co.uk: The BBC reports on DragonForce's attacks on Co-op, details data theft.
- www.thetimes.com: The Sunday Times article details the DragonForce attack on Marks & Spencer.
- BleepingComputer: Cybersecurity firm BleepingComputer reported the Co-op's confirmation of significant data theft, contrasting with previous downplayed assessments of the incident.
- Help Net Security: The Co-op hack is detailed with an update of stolen data and the impact on the company's systems.
- DataBreaches.Net: BleepingComputer reports on the escalation of the Co-op cyberattack, with hackers boasting about stealing data from millions of customers.
- arcticwolf.com: Threat Event Timeline 22 April 2025 – Marks & Spencer released a cyber incident update on the London stock exchange website.
- Rescana: Detailed Report on the DragonForce Cyber Attack on Co-op Introduction: The DragonForce cyber attack on Co-op has emerged as a significant...
- Tech Monitor: The Co-op Group has acknowledged a substantial data breach in a cyberattack that was reportedly perpetrated by the DragonForce group.
- arcticwolf.com: Threat Event Timeline 04/22/2025 – Marks & Spencer released a cyber incident update on the London stock exchange website. The incident resulted in the organization having to pause online clothing orders for six days.
- www.techradar.com: Hackers claim to have stolen private information on 20 million Co-op shoppers
- cyble.com: Cyberattacks Hit Leading UK Retailers as NCSC Urges Stronger Defences
- cyble.com: Multiple cyberattacks have recently struck some of the UK’s most iconic retailers, prompting concern from industry leaders and cybersecurity authorities.
- www.cybersecurity-insiders.com: NCSC issues alert against more ransomware attacks on retailers
- www.itpro.com: In an official statement, addressed the situation, saying: “The disruption caused by the recent incidents impacting the retail sector are naturally a cause for concern to those businesses affected, their customers, and the public.
- cyberinsider.com: Cyber Insider reports on Co-op Confirms Member Data Breach Following Cyberattack Incident
- Check Point Research: Three major UK retailers – Co-op, Harrods and Marks & Spencer (M&S) – were hit by cyberattacks that disrupted operations and compromised sensitive data.
- www.bleepingcomputer.com: Marks and Spencer breach linked to Scattered Spider ransomware attack
- cyberinsider.com: NCSC Issues Urgent Guidance After Major UK Retailers Breached by Hackers
- www.cybersecurity-insiders.com: New Cyber threats emerge from Cyber Attacks on UK Companies.
- TechInformed: Recent retail cyber attacks have highlighted growing vulnerabilities in the UK sector.
- techinformed.com: A recent spate of retail cyber attacks has highlighted growing vulnerabilities in the UK sector, with high street names including M&S, the Co-op and Harrods…
- Cybersecurity Blog: The Marks and Spencer Cyber Attack: Everything You Need to Know
- www.exponential-e.com: NCSC warns of IT helpdesk impersonation trick being used by ransomware gangs after UK retailers attacked
- Phishing Tackle: Co-op has revealed that its recent breach was far more serious than initially reported, with a significant amount of data from current and former customers stolen.
- bsky.app: NCSC warns of IT helpdesk impersonation trick being used by ransomware gangs after UK retailers attacked.
- www.cysecurity.news: The United Kingdom’s National Cyber Security Centre (NCSC) has issued a stark warning following a wave of cyberattacks targeting some of the country’s most prominent retail chains.
Dissent@DataBreaches.Net
//
British retailer Marks & Spencer (M&S) has been hit by a significant cyberattack, causing disruptions to its online order system and in-store contactless payments. The incident, which began last week, led to the temporary suspension of online orders and refunds for some customers. Cyber security experts now suspect the infamous Scattered Spider hacking collective is behind the attack, potentially crippling the retailer's systems and its ecommerce operation.
BleepingComputer reports that the ongoing outages at M&S are likely the result of a ransomware attack. The Scattered Spider group, known for targeting major organizations, is believed to have initially breached M&S's systems as early as February, allegedly stealing the NTDS.dit file from the Windows domain. This file contains user account and password information, enabling the attackers to move laterally across the network and gain control over more systems. The group then reportedly deployed the DragonForce encryptor against M&S’s virtual machines running on VMware ESXi hosts, launching the main attack on April 24th.
The cyberattack's impact extends beyond online services. M&S has acknowledged "pockets of limited availability" in its physical stores, with reports of empty shelves nationwide, indicating disruptions to the supply chain. Scattered Spider, also known as Octo Tempest, is a cybercriminal collective known for its sophisticated social engineering tactics, phishing, and multi-factor authentication (MFA) bombing, posing a significant threat to large enterprises. The attack on M&S underscores the urgent need for organizations to bolster their cybersecurity defenses and remain vigilant against evolving threats.
Recommended read:
References :
- bsky.app: Cyber security website @bleepingcomputer.com now reporting that the M&S hackers could be from Scattered Spider
- hackread.com: Scattered Spider Suspected in Major M&S Cyberattack
- research.checkpoint.com: British retailer Marks & Spencer (M&S) experienced a cyber-attack that caused disruptions to its online order system and in-store contactless payments.
- ComputerWeekly.com: The infamous Scattered Spider hacking collective may have been behind the ongoing cyber attack on Marks and Spencer that has crippled systems at the retailer and left its ecommerce operation in disarray.
- DataBreaches.Net: Marks & Spencer breach linked to Scattered Spider ransomware attack
- BleepingComputer: Marks and Spencer breach linked to Scattered Spider ransomware attack.
- Tech Monitor: Cyberattack at Marks & Spencer, suspected to involve Scattered Spider hackers.
- www.bleepingcomputer.com: Marks & Spencer breach linked to Scattered Spider ransomware attack
- www.helpnetsecurity.com: Threat actors are from Scattered Spider, and that M&S’s virtual machines on VMware ESXi hosts have been encrypted with the DragonForce encryptor
- Help Net Security: Marks & Spencer cyber incident linked to ransomware group
- blog.checkpoint.com: The incident report details the significant disruptions to the retailer's systems, prompting the suspension of online orders and refunds for impacted customers.
- Check Point Research: The British retailer Marks & Spencer (M&S) experienced a cyber-attack that caused disruptions to its online order system and in-store contactless payments.
- Danny Palmer: The Co-op has been forced to shut down parts of its IT system after discovering an attempted hack only days after the fellow retailer Marks & Spencer faced a serious cyber incident.
- Silicon Republic: M&S woes continue as Scattered Spider ransomware suspected
- ComputerWeekly.com: The infamous Scattered Spider hacking collective may have been behind the ongoing cyber attack on Marks and Spencer that has crippled systems at the retailer and left its ecommerce operation in disarray.
- www.cybersecurity-insiders.com: DragonForce Ransomware behind Mark and Spencer digital outage
- www.cybersecurity-insiders.com: Almost a week ago, renowned UK-based retailer Marks & Spencer (M&S) became the victim of a devastating cyber attack that left the company in full-blown disruption mode.
- Metacurity: Scattered Spider might be behind M&S attack
- cyberinsider.com: Marks & Spencer has disclosed a cyberattack targeting its internal systems, leading to disruptions in back-office and customer support operations. While the incident prompted precautionary security measures, all retail stores, funeral homes, and quick commerce services remain open and fully operational.
- Risky Business Media: British retail stalwart Marks & Spencer gets cybered
- www.standard.co.uk: Cybersecurity researchers reported a ransomware attack on Marks & Spencer, impacting online ordering and financial systems, which was attributed to the Scattered Spider group.
- ComputerWeekly.com: The cyberattack on Marks & Spencer (M&S) is linked to the notorious Scattered Spider group.
- Searchlight Cyber: Scattered Spider Linked to Marks & Spencer Cyberattack
- thecyberexpress.com: Marks & Spencer Confirms Cybersecurity Incident After Days of Service Disruptions
ross.kelly@futurenet.com (Ross@Latest from ITPro in News
//
Marks & Spencer (M&S), a major British retailer, has confirmed that it is currently managing a cybersecurity incident. This confirmation follows several days of reported service disruptions affecting store operations and customer experiences. The company issued a statement acknowledging the incident and apologized to customers for any inconvenience caused. M&S has implemented operational changes to protect the business and its customers during this time.
Customer impact includes disruptions to contactless payments, online orders, and the Click & Collect service. Some customers reported issues as far back as Saturday through social media platform X, ranging from returns being unavailable to Click & Collect orders being delayed or unavailable. While M&S stated that stores remain open, the website and app are operating normally, and contactless payments are working again, the company is working hard to resolve the remaining technical issues. M&S claims it serves 32 million customers every year.
In response to the cyber incident, Marks & Spencer has engaged external cybersecurity experts to investigate the matter and strengthen its network security. The company has also notified the Information Commissioner's Office (ICO) and the National Cyber Security Centre (NCSC). While the exact nature of the cyberattack and the extent of any potential data breach have not been fully disclosed, M&S has assured customers that it is taking the situation seriously and will provide updates as appropriate. Customer trust is incredibly important to the company and if the situation changes an update will be provided as appropriate.
Recommended read:
References :
- CyberInsider: Marks & Spencer (M&S) has confirmed it is responding to a cybersecurity incident that has caused disruptions across its UK retail operations, including outages in payment systems and delays in store services such as order pick-ups and click-and-collect.
- techcrunch.com: The company said it was necessary to make operational changes to protect the business.
- www.itpro.com: Retail giant Marks & Spencer (M&S) has revealed it has been dealing with a “cyber incident†in recent days and apologized to customers amid disruption complaints.
- The Register - Security: Retailer tight-lipped on details as digital hiccup disrupts customer orders UK high street mainstay Marks & Spencer told the London Stock Exchange this afternoon it has been managing a "cyber incident" for "the past few days."…
- cyberinsider.com: Marks & Spencer (M&S) has confirmed it is responding to a cybersecurity incident that has caused disruptions across its UK retail operations, including outages in payment systems and delays in store services such as order pick-ups and click-and-collect.
- Zack Whittaker: New, by me: Marks & Spencer has confirmed a cyber incident, as customers report disruption and outages. The U.K.-headquartered retail giant said it made operational changes to "protect" the business, and has notified data protection authorities.
- The DefendOps Diaries: The Defend Ops Diaries article on Marks & Spencer Cyberattack: A Wake-Up Call for Retail Cybersecurity
- securityaffairs.com: Marks & Spencer (M&S) is managing a cyber incident
- techcrunch.com: TechCrunch article on Marks & Spencer confirms cybersecurity incident amid ongoing disruption
- BleepingComputer: Marks & Spencer confirms a cyberattack as customers face delayed orders
- ComputerWeekly.com: Cyber attack downs systems at Marks & Spencer
- www.cybersecurity-insiders.com: Mark & Spencer hit by Cyber Attack on Easter
- hackread.com: M&S Cyberattack Disrupts Contactless Payments and Click & Collect Services
- www.scworld.com: Marks & Spencer disrupted by cyberattack
- thecyberexpress.com: UK retail giant Marks & Spencer has confirmed it is managing a cybersecurity incident, following several days of service disruption that affected store operations and customer experiences.
- Tech Monitor: Marks & Spencer hit by cyberattack, services disrupted
- The Record: In a statement filed to London’s stock exchange on Tuesday afternoon, retailer Marks & Spencer said it made “some minor, temporary changes to our store operations†as soon as it became aware of the incident.
- bsky.app: Marks & Spencer (M&S) has disclosed that it is responding to a cyberattack over the past few days that has impacted operations, including its Click and Collect service. https://www.bleepingcomputer.com/news/security/marks-spencer-confirms-a-cyberattack-as-customers-face-delayed-orders/
- hackread.com: Marks & Spencer (M&S) cyberattack disrupts contactless payments and Click & Collect; investigation launched as retailer apologises and…
- techinformed.com: TechInformed report on M&S cyber attack impacting click and collect.
- www.cybersecurity-insiders.com: Mark & Spencer hit by Cyber Attack on Easter
- TechInformed: M&S cyber attack impacts click and collect and contactless payments
- The Register - Security: M&S takes systems offline as 'cyber incident' lingers
- ComputerWeekly.com: M&S systems remain offline days after cyber incident
- BleepingComputer: Marks & Spencer pauses online orders after cyberattack
- The Register - Security: M&S suspends all online orders as 'cyber incident' issues worsen
- bsky.app: M&S stops online orders following cyber attack. Fall-out from this cyber attack is getting worse not better 4 days after customers were alerted to an attack.
- bsky.app: Bsky social network post about Marks & Spencer pausing online sales after cyberattack
- ComputerWeekly.com: M&S systems remain offline days after cyber incident
- www.itpro.com: M&S suspends online sales as 'cyber incident' continues
- cyberinsider.com: Marks & Spencer Suspends Online Orders Amid Ongoing Cyber Incident
- The DefendOps Diaries: Marks & Spencer Cyberattack: Operational Disruptions and Strategic Responses
- CyberInsider: Marks & Spencer Suspends Online Orders Amid Ongoing Cyber Incident
- bsky.app: Marks & Spencer has paused online orders for customers.
- go.theregister.com: One step forward and one step back as earlier hopes of progress dashed by latest update Marks & Spencer has paused online orders for customers via its website and app as the UK retailer continues to wrestle with an ongoing "cyber incident."
- Check Point Research: For the latest discoveries in cyber research for the week of 28th April, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES British retailer Marks & Spencer (M&S) experienced a cyber-attack that caused disruptions to its online order system and in-store contactless payments.
- www.bleepingcomputer.com: Marks & Spencer pauses online orders after cyberattack
- bsky.app: Ongoing outages at British retail giant Marks & Spencer are caused by a ransomware attack believed to be conducted by a hacking collective known as "Scattered Spider"
- BleepingComputer: Ongoing outages at British retail giant Marks & Spencer are caused by a ransomware attack believed to be conducted by a hacking collective known as "Scattered Spider" BleepingComputer has learned from multiple sources.
- BleepingComputer: Ongoing outages at British retail giant Marks & Spencer are caused by a ransomware attack believed to be conducted by a hacking collective known as "Scattered Spider"
- www.bleepingcomputer.com: Ongoing outages at British retail giant Marks & Spencer are caused by a ransomware attack believed to be conducted by a hacking collective known as Scattered Spider BleepingComputer has learned from multiple sources.
- Help Net Security: The “cyber incident†that British multinational retailer Marks & Spencer has been struggling with for over a week is a ransomware attack, multiple sources have asserted.
- DataBreaches.Net: Multiple sources inform them that the outages at UK retail giant Marks & Spencer are the result of a ransomware attack by the group known as Scattered Spider.
- bsky.app: Cyber security website @bleepingcomputer.com now reporting that the M&S hackers could be from Scattered Spider. This infamous hacking crew is behind a string of attacks in the last 2 years and its members include English-speaking teenagers. https://www.bleepingcomputer.com/news/security/marks-and-spencer-breach-linked-to-scattered-spider-ransomware-attack/
- ComputerWeekly.com: The infamous Scattered Spider hacking collective may have been behind the ongoing cyber attack on Marks and Spencer.
- hackread.com: The cyberattack on Marks & Spencer (M&S) is linked to the notorious Scattered Spider group. Explore the severe…
- Tech Monitor: Cyber incident at Marks & Spencer suspected to involve Scattered Spider hackers
|
|
FlagThis - #retailsecurity