Cybercrime Hits UK Retail: What Business Leaders Must Know

Picture waking up to headlines revealing your business has been targeted by a sophisticated cyber-attack. This recent harsh reality, of stolen customer data and significant operational disruption, faced by UK retail giants Marks & Spencer and Co-op, has exposed the extreme vulnerability of retail cyber security.

So, what is the story behind these attacks, and how can you protect your business from becoming the next headline in cybercrime news?

The breaches brought to light exhibit the rising threat from organised cybercrime groups like Scattered Spider and DragonForce. While the full scope is still unravelling, what is clear is that these incidents emphasise that businesses can no longer afford insufficient cyber security measures.

While publicly available technical insights about these attacks remain sparse, our security teams have put together a high-level overview based on our experiences with similar incidents and our threat intelligence regarding the known threat actor.

What do we know so far?

Scattered Spider, notorious for its sophisticated social engineering and sky-high ransom demands against high revenue European and US companies, in exchange for not leaking sensitive company and customer data, allegedly orchestrated the attacks. Yet, newer ransomware group DragonForce has publicly claimed responsibility.

Reports from both BBC and the National Cyber Security Centre suggest that social engineering (hacking through human error) was the gateway, with crafty manoeuvres like smishing (SMS) or vishing (voice phishing), bypassing defences and gaining access to C-suite, IT, or security roles.

Both M&S and Co-op have suffered significant operational and reputational damage as a result of the attacks. And the M&S share price has dropped by over 14%, wiping more than £1 billion from its market capitalisation. Fully recovering from this cyber attack will be a lengthy and challenging process – if it’s even achievable at all.

Who is most under threat?

Major enterprises in sectors such as retail, finance, telecommunications, hospitality, and cloud services are prime targets for these cyber predators. Why? Their operational complexity and high value data make them especially tempting for Scattered Spider. While patterns of behaviour exist for this most disruptive and innovative cybercriminal collective, it continually adapts tactics, techniques, and procedures (TTPs) to bypass security controls, so unpredictability remains their powerful weapon. The question isn’t “if” but “when” they will strike again.

"Protecting data is not a luxury - it's a fundamental necessity. Cyber threats are evolving rapidly, and organisations of all sizes are at risk. Insider knowledge confirms that cyber security must be embedded into your core business strategy - it's not optional.” - Paul Colwell, Chief Information Security Officer, Wavenet.

What can you do to protect your business?

These recent attacks aren’t isolated incidents; they’re part of a broader surge in targeted, sophisticated cybercrime. But – have no fear – proactive measures can drastically reduce your risk:

Deploy phishing-resistant multi-factor authentication (MFA)

Secure your access points with advanced MFA solutions including hardware security keys (such as YubiKey) and modern app-based number matching.

Enforce strict call-back verification for password resets

Enhance your password reset procedures and instate strict call-back verification protocols. This ensures the identity is thoroughly confirmed before any sensitive account changes are made.

Implement network segmentation

Implement VLANs, firewalls, and access controls, and regularly test segmentation effectiveness to isolate critical systems and limit lateral movement by attackers.

Patch business-critical systems in a timely manner

Stay updated, monitor for new vulnerabilities, schedule and deploy patches, and verify successful updates to minimise the window of exposure to known exploits.

Regularly test your data backups, failover and failback

Schedule and conduct regular backup tests, including failover and failback exercises, to ensure data can be restored quickly and reliably in a crisis.

Monitor security logs for suspicious activity

Implement 24/7 security monitoring with a Security Operations Centre (SOC) across your environment, using advanced SIEM (Security Information and Event Management) tools. This detects, investigates, and responds to suspicious activity in real time.

Perform regular penetration tests including social engineering assessments

Engage in regular testing with CHECK and CREST-accredited penetration testers that will conduct regular technical and social engineering assessments (such as phishing simulations and vishing) and provide detailed reports and actionable recommendations to address weaknesses.

Create and rehearse business continuity & incident response plans

Regularly rehearse Business Continuity and Incident Response Plans and facilitate tabletop exercises and live simulations to ensure your team is prepared for incidents.

Prepare and protect your data using the 3-2-1 strategy

Regularly review backup strategies to ensure compliance and resilience and follow the 3-2-1 rule: three copies of your data, on two different types of storage, with one copy off-site (or in the cloud).

Ensure your data is immutable or air-gapped

Configure immutable backups (that can’t be altered or deleted, even by attackers) and set up air-gapped storage solutions, providing maximum protection against ransomware and insider threats.

All of these measures will help. The key question is - are you confident that your organisation can withstand such organised cyber onslaughts?

Paul Colwell continues: “Every employee and every process must treat security as a vital requirement, because if human error or complacency creates vulnerabilities, it could cost your organisation greatly. It's not just prevention; it's safeguarding!".

Is your business prepared for what’s next?

These disruptive organised attacks are increasing and other major UK retailers such as Harrods have already become victims. But this isn’t the only type of threat that is intensifying.

Ransomware, AI-driven attacks, phishing, DDoS, supply chain compromises, insider threats, and vulnerabilities in cloud, containers, and emerging technologies are all increasing in frequency and sophistication.

Businesses must evolve, too, bolstering detection, response and resilience strategies to stay ahead.

Our Cyber and Operational Resilience expert Martin Lewis, adds a cautionary word to make sure your approach to backup and recovery is part of your cyber resilience and not an afterthought. “Effective data protection strategies are not just compliance checkboxes, they are critical controls that can protect your sensitive data and help to contain the blast radius of a cyber incident.”