Marks & Spencer Hit by Cyberattack: What You Need to Know

A Major Retail Giant Faces a Digital Storm

In April, iconic UK retailer Marks & Spencer (M\&S) found itself grappling with a serious cyberattack that disrupted its payment infrastructure and exposed customer data. Known for its long-standing heritage and widespread consumer trust, M\&S had to move quickly to contain the damage with help from leading cybersecurity experts.

The incident, which came to light in a disclosure to the London Stock Exchange, impacted several services—most notably, card payments, gift card usage, and the popular Click & Collect service. While the website and app remained functional, M\&S acknowledged that it had to make “minor, temporary changes” to its in-store operations to protect both customers and business assets.

The attackers behind the breach were linked to the DragonForce ransomware group, a notorious cybercriminal syndicate also claiming responsibility for attacks on Co-op and attempts on luxury store Harrods. DragonForce reportedly employed tactics associated with the Scattered Spider group, leveraging social engineering methods to infiltrate the company’s VMware ESXi virtual machines.

Despite the swift action, M\&S confirmed that some personal customer data had been stolen. This data may include names, email addresses, phone numbers, dates of birth, order history, and even some household-related details. However, the retailer emphasized that no passwords or usable card payment data were compromised—only “masked” card details were stored on their systems.

In a further step to safeguard affected users, M\&S notified government authorities, including the National Cyber Security Centre and law enforcement. The company also reassured users that there is no current evidence the stolen data has been shared or misused. Nevertheless, customers are encouraged to remain vigilant for phishing attempts and follow cybersecurity best practices.

What Undercode Say:

The M&S data breach underscores a critical trend

This attack has many of the hallmarks of modern cyberwarfare. The DragonForce group utilized ransomware in combination with Scattered Spider-style social engineering—proving that human manipulation remains one of the most effective breach points in corporate security. These tactics bypass traditional technical defenses, targeting employees and third-party vendors to gain backdoor access.

The use of VMware ESXi encryption is another worrying sign. This is not your average ransomware hit—this targets virtual infrastructure at the root level. It’s an attack that requires not only technical acumen but also detailed insider knowledge or reconnaissance. That suggests the attackers had either significant preparation time or help from someone familiar with the environment.

For M\&S, the public-facing damage may be mitigated by the fact that no financial data or passwords were compromised. However, the exposed personal information can still be weaponized in identity theft schemes or phishing campaigns. Criminals don’t always need full card numbers to wreak havoc—they often piece together fragmented data from multiple leaks.

From a regulatory perspective, M\&S’s transparency and coordination with UK data protection agencies are commendable. It likely helped avoid larger fines under GDPR. But reputational harm—especially in a data-conscious UK market—could be long-lasting if customers lose trust.

This event also serves as a wake-up call for similar enterprises operating hybrid infrastructures. Physical stores paired with digital platforms create more complex attack surfaces. Businesses must implement zero-trust architectures, rigorous employee training, and real-time anomaly detection to withstand such multi-pronged assaults.

More broadly, Undercode sees this as part of an evolving pattern: ransomware gangs moving from purely financial targets to brands with legacy systems, valuable customer data, and public visibility. As cybercriminal groups become more organized and motivated by reputation as well as ransom, we’re entering a new phase of digital conflict where no brand is too traditional to be targeted.

✅ Fact Checker Results:

🔒 Data Breach Confirmed: Customer personal data (excluding full card details and passwords) was accessed.
🧠 Attack Method: Social engineering and ESXi-targeted ransomware used by known cybercriminal group.
🏛️ Compliance Action: Incident reported to UK data authorities and National Cyber Security Centre.

🔮 Prediction

As retail becomes more digitally integrated, hybrid retailers like M\&S will face rising threats from ransomware actors using increasingly personalized tactics. Expect more high-profile breaches throughout 2025, especially targeting enterprises balancing legacy infrastructure with modern e-commerce systems. M\&S may now accelerate investment in advanced cybersecurity protocols—while competitors should take this as a signal to audit and harden their own systems before they become the next target.

References:

Reported By: securityaffairs.com
Extra Source Hub:
https://www.facebook.com
Wikipedia
Undercode AI

Image Source:

Unsplash
Undercode AI DI v2

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram