M&S and Co-op Hacks Classified as Single Cyber Event – Source: www.infosecurity-magazine.com

The recent cyber-attacks on UK retailers Marks & Spencer (M&S) and The Co-op have been publicly linked, with the Cyber Monitoring Centre (CMC) assessing them as a single, combined cyber event.

The independent non-profit organization, made the assessment based on three factors:

• One threat actor is likely to be responsible for both attacks
• The close timing, with both incidents disclosed in late April 2025
• The similar tactics, techniques and procedures (TTPs)

Another UK retailer, Harrods, was hit by an attack at a similar time, which was also claimed by the same threat actor. However, the CMC has not linked the incident at this time given the low level of information about the cause and impact.

Hacking collective Scattered Spider has been widely attributed to the attacks on M&S, The Co-op and Harrods.

The CMC commented: “Attribution is ongoing, but current indicators suggest the same threat actor targeted M&S and Co-op using similar TTPs. The initial access vector is believed to involve social engineering, with reports suggesting compromised credentials and potential abuse of IT helpdesk processes.”

Significant Financial Impact Assessed

The CMC estimates the total financial impact of the M&S and The Co-op incidents to range from £270m-£440m.

This assessment used available data and established modelling, including costs relating to lost sales for the two retailers, their franchisees and suppliers. It also includes incident response and IT restoration, legal and notification costs.

Read now: M&S Braces for £300 Million Cyber-Attack Costs

For M&S, analysis by Fable Data, a provider of European consumer spend data, showed a reduction in average daily spend of 22% during the event for the period online shopping was unavailable.

For the Co-op, Fable Data showed an average fall in daily spend of 11% in the first 30 days of the event.

As a result of this economic impact, the CMC has categorized the incident as a Category 2 systemic event. This is based on its monitoring matrix for cyber events, which categorizes incidents from 1 to 5, with 5 the most severe.

The severity level is determined by the financial impact and number of organizations affected.

As a category 2 event, the M&S and The Co-op incident is considered “narrow and deep” – reflecting the significant impact for the two retailers a limited number of suppliers, partners and service providers.

This compares to the CrowdStrike outage in July 2024, where a large number of businesses across the economy were affected but the impact to any one company was far smaller.

The CMC noted that there is yet to be a “deep and broad” category 4 or 5 event in the UK.

“Had there been further widespread disruption in the sector, the categorisation could have been higher, but because the impact was confined to two companies and their partners, it is judged to be at the lower end of severity on the CMC’s scale,” the non-profit said.

The CMC provides publicly available cyber event categorizations, with the insights designed to help improve cyber mitigation and response plans.