The public advice after the April 2025 attacks on M&S, the Co-op and Harrods was about ordinary controls: how the helpdesk checks identity before a password or MFA reset, how widely 2-step verification is deployed, and how admin accounts are watched. The NCSC said on 4 May 2025 that it could not yet say whether the attacks were linked, so the lessons come from its advice, not from a confirmed attack chain.
What did the public sources say happened?
The NCSC published a statement on 1 May 2025 and said it was working with the affected organizations. Its chief executive, Richard Horne, said the incidents should act as a wake-up call to all organizations. The next day the ICO said it had received reports from M&S and the Co-op Group and was making enquiries with the NCSC. The full sequence is on our UK retail attacks 2025 incident page.
The Co-op described a sophisticated, multi-stage cyber attack in April. It restricted certain systems to contain the threat, which kept stores, payments and online services running but hurt product availability. M&S said it was the subject of a sophisticated cyber incident and was rebuilding some applications and file systems that could not be recovered.
- 22 April 2025M&S announces it is managing a cyber incidentM&S 2026 annual report
- 25 April 2025The date the Co-op’s chief executive gives for the attack on the Co-opConfirmed by the NCSC and NCA, he wrote
- 1 May 2025NCSC publishes its statement on the incidents
- 4 May 2025NCSC blog post with recommendations for retailersIt could not yet say whether the attacks were linked
- 10 July 2025NCA arrests four peopleInvestigation into attacks on M&S, Co-op and Harrods
Was it a helpdesk attack, and who was behind it?
The NCSC raised the question of whether social engineering had been used against IT helpdesks to reset passwords and MFA. It also noted press speculation that a group known as Scattered Spider was behind some incidents, and it did not confirm this. For this event there is no public attribution from the sources reviewed, so treat any group name as speculation.
CISA, with the FBI and partners including NCSC-UK, describes Scattered Spider as a group that targets large companies and their contracted IT help desks. Its update of 29 July 2025 says the actors posed as employees to get help desk staff to reset a password and transfer the MFA to a device they control. That page does not name the UK retailers, so it shows the technique, not what happened at these three companies.
On 10 July 2025 the NCA arrested two males aged 19, a 17-year-old and a 20-year-old female in the West Midlands and London. The suspicion covered Computer Misuse Act offenses, blackmail, money laundering and organized crime group activity. The NCA said its work continues with UK and overseas partners.
What did the NCSC tell retailers to check?
On 4 May 2025 the NCSC published recommendations. They read as a short list a CISO can test this week.
- Helpdesk identityReview how the helpdesk authenticates staff before it resets passwords.
- 2-step verificationDeploy 2-step verification (MFA) comprehensively.
- Admin accountsPay attention to Domain Admin, Enterprise Admin and Cloud Admin accounts and check access is legitimate.
- Unusual sign-insMake sure the security operations center can spot logins from atypical sources such as VPN services in residential ranges.
- Threat intelligenceBe able to use attacker techniques from threat intelligence rapidly.
Where could the damage have been limited?
Three points stand out in the sources: the helpdesk reset step, unusual sign-ins and admin account use, and the moment systems had to be restricted. The first two come straight from the NCSC advice above. The third is about cost. The Co-op estimated a 285 million pound revenue impact and a 107 million pound profit impact. Its chief executive said the deliberate segregation of systems and frequent testing laid a strong foundation for the response.
M&S booked a 131.3 million pound charge for the incident in 2025/26, of which 109.3 million pounds related to immediate systems response and recovery. Its Fashion, Home and Beauty sales fell 7.7 percent, reflecting the temporary pause in online trading and systems access, and the after-effects tapered but lasted until the end of the year. Both companies said they accelerated technology or cyber defense investment as part of recovery.
Sharing helped. The NCSC says its Retail Sector Trust Group was mobilized straight away, which let companies put controls in place and likely reduced the chance of other organizations being hit. The NCA thanked M&S, the Co-op and Harrods for their support and encouraged future victims to engage with law enforcement.
What should a security buyer ask now?
Each question below comes from a stated fact. Can your helpdesk resist a caller posing as an employee, given that CISA describes exactly that technique? Is 2-step verification deployed on every account, as the NCSC advised? Which systems could you restrict to contain an attack, and what would that do to stores, stock and orders, as it did for the Co-op? Do you have a route to the NCSC, and do you know how to report to the NCSC and the ICO, as M&S did?
If your team cannot answer that in one sentence, start there.
To go further, read the Jaguar Land Rover attack and the most targeted EU sectors.