Cyber Attacks on M&S, Co-op & Harrods: A Wake-Up Call for SMEs

What happened?

Marks & Spencer (M&S)

Over the Easter weekend, M&S experienced a sophisticated ransomware attack attributed to the hacker group Scattered Spider, which deployed the “DragonForce” ransomware. Attackers exploited vulnerabilities in M&S’s systems, gaining unauthorised access to customer data, including names, addresses, dates of birth, and order histories. While payment details and passwords remained secure, the breach led to the suspension of online orders from 25 April and disrupted store operations. The company has faced significant financial losses, with estimates suggesting over £1.2 billion wiped from its market value.

The Co-operative Group (Co-op)

Shortly after the M&S incident, the Co-op fell victim to a similar cyberattack. The ransomware attack compromised the Co-op’s ordering and logistics systems, leading to empty shelves and supply chain disruptions, particularly in rural areas. Customer and employee data, including contact information and birth dates, were accessed. Although payment systems remained mostly operational, the breach caused significant disruption.

Harrods

Harrods, the luxury department store, reported an attempted cyberattack on its systems. While the attack was identified and mitigated promptly, it underscores the broader trend of cyber threats targeting UK retailers. The incident led to restricted internet access in stores as a precautionary measure.

How it happened…

The attacks on M&S and the Co-op involved social engineering, with hackers impersonating IT staff to deceive help desk personnel into resetting passwords. This granted them access to internal systems and allowed ransomware to be deployed.

The primary reason was financial extortion. By encrypting critical systems and threatening to release sensitive data, attackers attempted to force organisations into paying ransoms.

The wake-up call for SMEs

If you’re a small or medium-sized business, it’s easy to assume you’re not a target, but that’s no longer true. Around 1 in 5 UK businesses, including a quarter of small firms, suffered a cyberattack in the last year.

Preparation is the biggest difference between those that survive and those that don’t. Here are practical steps SMEs should take now:

• Improve cyber hygiene: Keep systems patched and updated, use strong passwords, and ensure backups are secure and regularly tested.
• Train your team: Help employees recognise phishing attempts, suspicious links, and impersonation tactics.
• Create an incident response plan: Have clear procedures for isolating affected systems, informing stakeholders, and restoring operations.
• Get Cyber Essentials certified: This UK government-backed scheme sets out essential security controls and demonstrates your commitment to protecting data.

Understanding the threat

Social engineering exploits human psychology to manipulate individuals into divulging confidential information or performing actions that compromise security. Common tactics include:

• Phishing: Deceptive emails or messages that trick recipients into revealing sensitive information or clicking malicious links.
• Pretexting: Creating a fabricated scenario to persuade someone to share information or perform actions.
• Baiting: Enticing individuals with offers or downloads that contain malware.
• Tailgating: Gaining physical access to restricted areas by following authorised staff.

In the recent retail attacks, attackers used pretexting to impersonate IT staff, convincing help desk employees to reset passwords and grant system access.

Best practices to prevent social engineering

To protect against social engineering attacks, organisations should implement the following measures:

• Employee Training: Regularly educate staff on recognising and responding to social engineering tactics.
• Verification Protocols: Establish strict procedures for verifying identity before granting access or resetting credentials.
• Multi-Factor Authentication (MFA): Implement MFA to add an extra layer of security beyond passwords.
• Regular Security Audits: Conduct periodic assessments to identify and address vulnerabilities.
• Incident Response Plan: Develop and maintain a comprehensive plan to respond to security breaches promptly.

By creating a culture of security awareness and implementing robust protocols, organisations can significantly reduce the risk of falling victim to social engineering attacks.

Don’t wait until it’s your company in the headlines

The recent cyberattacks on M&S, the Co-op, and serve as a stark reminder that no organisation is immune. As cybercriminals employ increasingly sophisticated tactics, it is critical for organisations to prioritise cybersecurity measures, employee training, and incident preparedness to safeguard their operations and customer trust. The earlier you act, the better protected your business will be.

Learn more about our cyber security services or reach out to our client support teams for advice on how to enhance your security posture today.