Log in Request a demo

Significant cyber incident

UK retail attacks (M&S and Co-op)

In April 2025, Marks & Spencer, the Co-op Group and Harrods were hit by separate cyber attacks that the UK National Crime Agency investigated together.

In short

In April 2025, Marks & Spencer, the Co-op Group and Harrods were hit by separate cyber attacks that the UK National Crime Agency investigated together. M&S announced its incident on 22 April and the Co-op said it was attacked on 25 April. The NCSC noted press talk of social engineering aimed at IT helpdesks. M&S expected about 300 million pounds off group profit, and the Co-op estimated a 285 million pound revenue impact.

Last updated 9 October 2026

What happened

On 22 April 2025 M&S announced that it was managing a cyber incident. The Co-op Group’s chief executive later wrote that the Co-op was the victim of a multi-stage cyber attack on 25 April 2025. The National Crime Agency (NCA) says three attacks, on M&S, Co-op and Harrods, took place in April 2025.

The NCSC and the ICO both made public statements in the first days of May 2025. The NCSC said it was working with the affected organizations. The ICO said it had received reports from M&S and the Co-op Group.

On 10 July 2025 the NCA arrested four people in the West Midlands and London on suspicion of Computer Misuse Act offenses, blackmail, money laundering and taking part in an organized crime group. Public sources opened for this page do not give the technical details of how each company was breached.

Timeline

  1. 2025-04-22

    M&S announces that it has been managing a cyber incident.

  2. 2025-04-25

    The Co-op Group's chief executive later writes that the Co-op was the victim of a multi-stage cyber attack on this date.

  3. 2025-04-26

    M&S makes a further announcement about the incident (M&S lists announcements on 22 and 26 April and 13 May 2025).

  4. 2025-05-01

    The NCSC publishes a statement saying it is working with the affected organizations and calling the incidents a wake-up call.

  5. 2025-05-02

    The ICO says it has received reports from M&S and the Co-op Group and is making enquiries.

  6. 2025-05-04

    The NCSC publishes recommendations for retailers. It says it cannot yet say whether the attacks are linked.

  7. 2025-05-13

    M&S makes a further announcement about the incident.

  8. 2025-07-10

    The NCA arrests four people in the West Midlands and London in its investigation into the attacks on M&S, Co-op and Harrods.

  9. 2025-07-29

    CISA updates its Scattered Spider advisory with new help desk techniques and DragonForce ransomware. The page does not name UK retailers.

  10. 2026-03-26

    The Co-op's trading statement estimates a 285 million pound revenue impact and a 107 million pound profit impact.

  11. 2026-05-19

    M&S's 2026 annual report says it continues to cooperate with ICO and other regulator investigations.

How the attack worked

What the public record says

The Co-op says it faced a sophisticated, multi-stage cyber attack. It restricted certain systems to contain the threat, which kept stores, payments and online services running but hurt product availability. M&S says it was the subject of a sophisticated cyber incident and has been rebuilding some applications and file systems that could not be recovered.

Neither company, nor the NCA, has published a full technical account in the pages opened for this review. The NCSC said on 4 May 2025 that there was a lot it did not know and that it could not yet say whether the attacks were linked.

Helpdesk social engineering

The NCSC noted press discussion of whether social engineering was used against IT helpdesks to reset passwords and multi-factor authentication (MFA). It did not confirm this for the retail attacks. Its advice, aimed at that kind of technique, was to check how the helpdesk confirms a person’s identity before a reset, especially for accounts with high privileges.

Separately, CISA and its partners, including the NCSC, describe a group called Scattered Spider as targeting large companies and their contracted IT help desks. A 29 July 2025 update says its actors posed as employees to get help desk staff to reset a password and move the MFA to a device the actors control. That advisory does not name the UK retailers.

Defense advice from the NCSC

The NCSC advised deploying 2-step verification comprehensively, watching for unauthorized account misuse, checking Domain Admin, Enterprise Admin and Cloud Admin account access, and making sure security operations teams can spot logins from atypical sources such as residential VPN ranges.

Impact

M&S: its 2025 annual report expected an impact on group profit of around 300 million pounds for 2025/26, reduced by cost management, insurance and trading actions. Its 2026 annual report records a 131.3 million pound charge for the incident (109.3 million pounds for immediate systems response and recovery) and says Fashion, Home and Beauty sales fell 7.7 percent, reflecting the temporary pause in online trading and systems access. M&S says the after-effects on trading and availability lasted until year end.

Co-op: estimated 285 million pounds direct revenue impact and 107 million pounds impact on profit (86 million pounds margin and 21 million pounds of extra one-off costs). Co-op's chief executive said some members' data was accessed, such as names, contact details and dates of birth.

Harrods: the NCA names it as a target. The sources opened give no impact figures for Harrods.

NCSC Annual Review 2025: describes ransomware attacks on M&S, the Co-op and others in retail, with the sight of empty shelves.

Government and regulator response

  • 1 May 2025, NCSC: said it was working with the affected organizations and that the incidents should be a wake-up call. The NCSC Annual Review 2025 says its Retail Sector Trust Group was immediately mobilized.
  • 2 May 2025, ICO: confirmed reports from M&S and the Co-op Group, began enquiries and told customers to use strong, unique passwords.
  • 4 May 2025, NCSC: published recommendations on 2-step verification, account monitoring, privileged accounts and helpdesk reset processes.
  • 10 July 2025, NCA: arrested four people and seized their devices. It said the investigation was one of its highest priorities and thanked M&S, Co-op and Harrods.
  • Victims: M&S used external cyber security experts, reported to the NCSC and ICO, and sped up technology upgrades. The Co-op restricted systems, worked with the NCSC and NCA, and accelerated planned cyber defense investment. As at 19 May 2026 M&S said it continued to cooperate with ICO and other regulator investigations.

Lessons

  1. Helpdesk resets are a front door

    The NCSC told retailers to review how the helpdesk confirms identity before a password reset, especially for privileged accounts.

  2. Restricting systems has a cost

    The Co-op shut down parts of its own systems to contain the threat. Stores kept trading but stock availability suffered, with a 285 million pound revenue impact.

  3. Recovery can take a year

    M&S said after-effects on trading and availability lasted to the end of its financial year, and it rebuilt some systems that could not be recovered.

  4. Share early with the sector

    The NCSC says its Retail Sector Trust Group let other companies put controls in place and likely reduced the chance of further victims.

  5. Segregation and rehearsal help

    The Co-op's chief executive credited segregation of systems and frequent testing for a strong response.

  6. Report to the authorities

    The NCA thanked the victims for engaging with law enforcement, and four arrests followed within about three months.

What to check in your own organization

  1. Helpdesk identity checks

    Ask how your helpdesk confirms who is calling before it resets a password or MFA, and whether it differs for admin accounts.

  2. MFA coverage

    Check that 2-step verification is deployed on all accounts and remote access, not only on some.

  3. Privileged account watch

    List who holds Domain Admin, Enterprise Admin and Cloud Admin rights and alert on unexpected use.

  4. Unusual sign-ins

    Check that your security team can spot logins from unusual sources, such as VPN services in residential ranges.

  5. Containment plan

    Decide which systems you could shut down to contain an attack, and what that would do to stores, stock and orders.

  6. Offline recovery

    Test whether you can rebuild applications and file systems that cannot be recovered, and how long it takes.

  7. Sector contacts

    Check you have a route to NCSC advice and a sector information group, and know how to report to the NCSC, NCA and ICO.

Questions

Which companies were hit?

M&S, the Co-op Group and Harrods, according to the NCA, which says the three attacks took place in April 2025.

Has anyone been blamed for the attacks?

The NCSC and NCA have not named a group in the sources opened. The NCSC noted press talk of Scattered Spider on 4 May 2025 and said it could not yet say if the attacks were linked.

Were people arrested?

Yes. On 10 July 2025 the NCA arrested four people (aged 17, 19, 19 and 20) on suspicion of Computer Misuse Act offenses, blackmail, money laundering and organized crime group activity.

How much did it cost?

M&S expected around 300 million pounds off group profit for 2025/26 and booked a 131.3 million pound charge. The Co-op estimated 285 million pounds of revenue impact and 107 million pounds on profit.

Was customer or member data taken?

The Co-op's chief executive said some members' data was accessed, such as names, contact details and dates of birth. The M&S sources opened do not describe the data involved.

What did the NCSC advise?

Use 2-step verification everywhere, watch for misuse of admin accounts, review helpdesk reset processes and detect logins from atypical sources.

In our research

  1. UK retail attacks 2025: lessons for retailers October 2026
  2. NCSC Annual Review 2025: UK Cyber Threat Findings October 2026
  3. JLR cyber attack: what security buyers should ask October 2026
  4. Top 5 Ransomware Groups in Q2 2026: Who They Are, How They Operate, and What They Target July 2026
  5. Scattered Spider: An Emerging Cybercriminal Collective November 2025
  6. DragonForce Ransomware: From Hacktivism to High-Street Extortion September 2025

Sources

  1. NCSC statement: Incident impacting retailers National Cyber Security Centre
  2. Incidents impacting retailers: recommendations from the NCSC National Cyber Security Centre
  3. Statement on cyber incidents impacting retailers Information Commissioner's Office
  4. Retail cyber attacks: NCA arrest four for attacks on M&S, Co-op and Harrods National Crime Agency
  5. Annual Report and Financial Statements 2025 Marks and Spencer Group plc
  6. Annual Report and Financial Statements 2026 Marks and Spencer Group plc
  7. Our Members' Annual Report for 2025 The Co-operative Group
  8. Co-op navigates headwinds and looks forward with confidence, clarity and purpose (2025 trading statement) The Co-operative Group
  9. It's time to act: NCSC Annual Review 2025 National Cyber Security Centre
  10. Scattered Spider (AA23-320A) CISA

Browse the threat library

Keep exploring

Knowledge Hub

Threat group

Scattered Spider

Scattered Spider is described by MITRE ATT&CK and by the FBI, CISA and partner agencies as a cybercriminal group that targets large companies and their IT help desks, mainly by tricking staff into resetting passwords and MFA. The UK National Crime Agency said on 16 July 2026 that its action against two leading members effectively halted the group, while others may reuse the name.

Read more

Glossary term

Social engineering

Social engineering is the act of tricking a person into revealing information, giving access or committing fraud.

Read more