Key Points from the Article:

• Multiple Major Targets: A significant number of retailers and suppliers, including well-known names like Marks & Spencer (M&S), Co-op, Harrods, Dior, a government legal aid office, and a food distributor for Tesco, Sainsbury’s, and Aldi, have recently been victims of cyber incidents.
• Ongoing Attacks: The problem is current, with new victims emerging, such as logistics firm Peter Green Chilled and food giant Arla Foods.
• Data Breaches: In some incidents, hackers successfully accessed computer systems and stole customer data, including dates of birth and addresses. Co-op proactively shut down its IT system to prevent the theft of sensitive personal and financial information like shopper passwords or bank details.
• Operational Impact: These cyber incidents have had tangible consequences, causing company stocks to tumble, leading to empty shelves in stores as supply chains were affected (like at M&S), and deliveries being paused.

Why Are Retailers Being Targeted?

• "Big Brand, Big Data, Big Target" (M&S Example):
• According to Joe Jones, CEO of cybersecurity firm Pistachio, M&S is a high-value target due to its household name status and vast, loyal customer base.
• Large retailers hold enormous amounts of personal data (names, addresses, purchase histories), which is "gold dust" for attackers running social engineering scams or selling verified profiles on the dark web.
• Retailers' extensive digital footprints (websites, mobile apps, marketing emails, delivery services) offer multiple "digital touchpoints that can be exploited."
• Retail Sector Vulnerability:
• James Hadley, founder of cybersecurity firm Immersive, notes that the retail sector isn't as heavily regulated as financial services, so the "burden of proof is lower on how you demonstrate and prove cyber security."
• He emphasizes that 100% security is impossible; a single point of failure (supplier, connection, employee, misconfiguration) can allow attackers in to deploy malware like ransomware.
• Retailers like M&S, with decades of operation, have "sprawling IT estates" with legacy systems that are harder to secure compared to newer organizations.

How Did the Hacks Happen?

• Details Undisclosed: Most victims haven't revealed the exact methods used by the attackers. The National Cyber Security Centre stated officials aren't sure if the attacks are linked.
• Social Engineering Suspected: Cybersecurity analyst James Hadley believes "social-engineering attacks on service desks" were used for initial access. This involves deceiving someone (e.g., via email or phone call impersonating IT support) to get credentials.
• Human Error & Dwell Time: Joe Jones described the M&S attack as not "sophisticated," stemming from human error. Attackers reportedly gained access through a third-party contractor and remained in M&S's systems for over two days before detection, a concerning "dwell time."
• Attribution: The attacks have been linked to a hacking collective called Scattered Spider, with the ransomware potentially created by DragonForce, a group whose previous targets include Coca-Cola and Yakult.

What Can Attackers Do With Stolen Information?

• Fuel Scams: Stolen data is often used in phishing emails (e.g., fake parcel delay notifications) and other scams.
• Impersonation: Hackers can use gathered personal information to convincingly impersonate companies like M&S via phone or email to trick individuals into revealing more data.

Advice for Affected Shoppers (e.g., M&S Customers):

• Be "Hyper-Aware": Even if financial data wasn't directly swiped, be vigilant for suspicious communications.
• Change Passwords: A standard security measure.
• Enable Stronger Security: Use two-factor authentication (app-based or hardware key) where possible.
• Adopt a "Zero-Trust Mindset": Be wary of unexpected communications purportedly from the retailer; verify by going directly to their official website or app.
• Expect More Incidents: Experts warn that attacks on the retail supply chain may continue or increase as attackers recognize it as a potentially vulnerable sector.

TL;DR: Major retailers like M&S and Co-op (and their suppliers) got hit by cyberattacks, leading to data theft and operational chaos (empty shelves, paused deliveries). Hackers are after the "gold dust" of customer data, often getting in via social engineering or exploiting third-party contractors. Experts say retailers can be easy targets due to less stringent security regulations and complex, older IT systems. Customers should be extra vigilant about scams and bolster their online security.

https://metro.co.uk/2025/05/13/surprising-tactics-hackers-targeting-major-firms-like-m-amp-s-co-op-23077018/