The Attack On M&S Reverberates Three Weeks Later

The chaotic problems at British retail giant Marks & Spencer (M&S) are being caused by a ransomware attack believed to be conducted by threat actors known as Scattered Spider.  

M&S is a British multinational retailer that employs 64,000 employees and sells various products, including clothing, food, and home goods in over 1,400 stores worldwide. The retailer is dealing with some major issues, with empty shelves not replenished and delays to its online shopping services.

Now, M&S have disclosed that customers’ personal data has been taken and must comply with the legal requirement to report this to the UK Information Commissioner's Office (ICO) under the 2018 UK Data Protection Act.

M&S's assessment that customers don't need to take immediate action is based on the critical fact that payment details and passwords were not compromised, which does significantly reduce the most severe and immediate financial risks however, after any cyber incident it is important to remain alert after any data breach. Here are some simple tips to maintain security - 

  • Remain Alert of suspicious communications: Be extra cautious of any emails, calls, or texts claiming to be from people associated with M&S or other companies, especially if they ask for personal or financial information, or contain links you're unsure about. 
  • Use strong, unique passwords: consider changing passwords immediately to maintain secure access, it is good practice to use unique and strong passwords for all your online accounts. If you've reused your M&S password on other sites, consider changing them all also. 
  • Enable Two-Factor Authentication (2FA): If the option is available always apply 2FA for your accounts. This adds an extra layer of security and makes it harder for attackers to gain access to sensitive systems 
  • Monitor your accounts: Keep an eye on your online accounts for anything unusual. 

Scattered Spider is known for its ability to target large multisite companies and breaching their data. Since the attack commenced last weekend M&S has lost more than £700 million, wiped off its stock market valuation.

Shoppers are still able to browse online and shop in M&S’s physical stores using cash or cards, but some major problems continue in stores, with gift cards not currently being accepted. Returning goods is only possible in clothing and homeware stores or via post. Food stores are not currently able to accept returns.

In expert comment, Chief Security Officer & EVP Information Security, Tim Grieveson at ThingsRecon said "It is noted that M&S is indicating a lower risk due to the exclusion of sensitive financial and password data, however in my opinion it does not mean that customers are not at risk even when these specific details are not compromised. As we know, these scams are on the rise and might try to convince customers into revealing passwords, financial details, or clicking on malicious links. Email addresses and other contact information could also be sold to spammers or other malicious actors, leading to an increase in unsolicited emails, calls, or texts.   

"M&S has stated that customers will be prompted to reset their password the next time they log in as an "extra peace of mind" measure. While this isn't a direct result of passwords being stolen, it's a good security practice to ensure existing credentials aren't compromised by other means or used in credential stuffing attacks where attackers try stolen username/password combinations from other breaches on your M&S account”. 

Scattered Spider, also known as 0ktapus, Starfraud, Scatter Swine and Muddled Libra is a classification of threat actors that are adept at using social engineering attacks, phishing, multi-factor authentication (MFA) bombing (targeted MFA fatigue), and SIM swapping to gain initial network access on large organisations.

Scattered Spider members have typically engaged in data theft for extortion and have been known to use BlackCat ransomware.

This hacking group includes young members as young as 16 and is based in the UK and US, with a range of skills and the group began hacking in financial fraud and social media but now steals crypto-currency and hacks company data in extortion attacks. Some Scattered Spider members are thought to be part of The Comm, a group involved in high-profile cyber incidents and they use of different individuals for each attack make them difficult to track.

One of Scattered Spider's biggest exploits was at the gaming giant MGM Resorts International in September 2023, when guests reported difficulty accessing rooms and using casino games. MGM operates over 30 hotel and gaming venues around the world was alerted to a potential hack when Scattered Spider brought MGM systems to a halt after they gained access to the company's management systems and were able deploy ransomware.

In that exploit, MGM confirmed that some customers personal data was stolen, including names, dates of birth and driving license numbers. In some cases, social security numbers and passport numbers were also involved. 

In the latest exploit against M&S, Grievson concludes that "While the risk is indeed lower than a breach involving payment or password details, it's not entirely absent. Staying informed and practicing good online security habits is always the best defence as well as staying alert and practicing good digital hygiene." 

ITV   |   Bleeping Computer   |   Drapers   |   The Times   |  Guardian  |   BBC 

Image: Ideogram

You Might Also Read:

CISOs Guide To Compliance & Cyber Hygiene:


If you like this website and use the comprehensive 8,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 






 

« Five Top-Rated Threat Intelligence Platforms
Co-op Shuts Down IT Systems After Attempted Hack »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Shavlik Protect

Shavlik Protect

Shavlik Protect is an easy-to-use security software solution that discovers missing patches and deploys them to the entire organization.

Axiomatics

Axiomatics

Axiomatics provides dynamic authorization and access control solutions to protect critical data assets.

HelseCERT

HelseCERT

HelseCERT is the health and care sector's national information security center for Norway.

NetDiligence

NetDiligence

NetDiligence is a privately-held cyber risk assessment and data breach services company.

The Open Group

The Open Group

The Open Group: Leading the development of open, vendor-neutral IT standards and certifications.

GraVoc

GraVoc

GraVoc is a technology-consulting firm committed to solving business problems for customers through the development, implementation, & support of technology-based solutions.

Fugue

Fugue

Fugue ensures cloud infrastructure stays in continuous compliance with enterprise security policies.

Cyberspace Solarium Commission (CSC)

Cyberspace Solarium Commission (CSC)

The Cyberspace Solarium Commission was established to develop a consensus on a strategic approach to defending the United States in cyberspace against cyber attacks of significant consequences.

HB-Technologies

HB-Technologies

HB-Technologies is pioneer in Africa, in digital security, embedded electronic and IT solutions based on highly secure smart cards that comply with international standards and norms.

Unlimited Technology

Unlimited Technology

Unlimited Technology offers a wide range of talent and experience, from assessing your requirements to implementing technologically advanced security solutions to best fit your needs.

Capital Network Solutions

Capital Network Solutions

Capital Network Solutions are a highly accredited managed IT services and consultancy provider, specialising in cyber security, infrastructure and communications.

AdvIntel

AdvIntel

AdvIntel is a next-generation threat prevention and loss prevention company launched by a team of certified investigators, reverse engineers, and security experts.

Epic Machines

Epic Machines

Epic Machines is a Value Added Reseller and Managed Security Services provider offering Security Transformation using Cloud-native solutions to commercial and government markets.

Armata Cyber Security

Armata Cyber Security

Armata exists to bring Cyber Security to all people – from home users and SMBs to large enterprises. We believe all users have the right to an affordable yet effective Cyber Security solution.

Sprocket Security

Sprocket Security

Sprocket Security protects your business by monitoring the cybersecurity landscape and performing continuous penetration testing services.

QPoint Technologies

QPoint Technologies

QPoint provides solutions and consulting in areas including software engineering, testing, cybersecurity, ICT, web, mobile, project management, and complex integration processes.