What if a single phone call could bring one of Britain’s best-known retailers to a standstill? That is the question the Marks & Spencer cyber attack forced every security team to ask. Over the Easter weekend in April 2025, customers couldn’t use contactless payments or click-and-collect, and within days online ordering was shut down entirely. The Marks & Spencer cyber attack is now a case study in how social engineering, stolen credentials, and ransomware combine, and in what any organization can do to avoid the same fate.
What Happened in the Marks & Spencer Cyber Attack
The Marks & Spencer cyber attack was a ransomware incident that disrupted payments, online sales, and stock systems across the retailer.
Marks & Spencer Cyber Attack Timeline
- February 2025: Attackers are believed to have first gained access to M&S’s network, according to sources who spoke to BleepingComputer.
- Easter weekend, April 2025: Customers were unable to make contactless payments or use click-and-collect.
- 24 April: The DragonForce encryptor was deployed on VMware ESXi hosts, encrypting virtual machines.
- 25 April: M&S disclosed the breach and suspended online shopping.
- June 10: Online clothing orders resumed after a 46-day suspension, though click-and-collect took months longer to return.
- July 2025: UK police arrested four people under 21 in connection with attacks on M&S, the Co-op, and Harrods.
How Did Attackers Break Into M&S?
Social Engineering and Third-Party Access
Reports indicate the attackers didn’t start with advanced malware. They reportedly impersonated an employee and persuaded a third-party IT contractor to reset credentials. Whatever the exact method, the lesson is the same: help desks and vendors are high-value targets.
Weeks of Hidden Access
Once inside, the attackers reportedly used stolen administrative credentials and legitimate remote administration tools to stay hidden while moving through the network. Researchers say they also took the Active Directory database holding password hashes for every domain user. This long dwell time, roughly two months before encryption, is why monitoring matters.
Ransomware on Virtualization Servers
By encrypting virtual machine hosts, the attackers took down many systems at once, including e-commerce, payments, and logistics. Concentrated infrastructure means a single point of failure unless it is hardened and segmented.
The Impact of the M&S Cyber Attack
Operations
Online sales stopped for weeks, and automated stock systems were shut down, leading to empty shelves at stores during May.
Financial Cost
M&S estimated the Marks & Spencer cyber attack cost it about £300 million in operating profit. Reports also put the loss in market value at over £1.2 billion.
Customer Data
M&S confirmed that hackers stole personal customer information. For customers, that raises the risk of phishing and identity fraud, which is why breached companies should communicate quickly and clearly.
Who Was Behind the M&S Cyber Attack?
Sources linked the attack to the group known as Scattered Spider, acting as an affiliate of the DragonForce ransomware operation. M&S’s chairman told lawmakers that loosely aligned parties had worked together under suspected DragonForce leadership. Arrests are not convictions, so treat the individuals as suspects unless courts rule otherwise. The same wave also hit the Co-op and Harrods, showing that attackers often work through a whole sector.
8 Lessons From the Marks & Spencer Cyber Attack
1. Verify Identity Before Any Password Reset
Require strong verification for help desk resets: callbacks to known numbers, manager approval for privileged accounts, and no resets on voice request alone. Apply the same rules to outsourced support.
2. Use Phishing-Resistant MFA
Standard MFA can be bypassed through social engineering. Use phishing-resistant methods such as hardware keys or passkeys for administrators and remote access.
3. Protect Active Directory and Limit Privilege
Treat domain controllers as crown jewels. Remove unnecessary admin rights, monitor for credential dumping, and watch for new privileged accounts.
4. Manage Third-Party Risk
Vendors with access to your systems are part of your attack surface. Review their access, require security standards in contracts, and monitor their activity.
5. Detect Intruders Before Encryption
Attackers lingered for weeks. Endpoint detection and response (EDR), threat hunting, and 24/7 monitoring shrink that window by flagging unusual admin tool use and lateral movement.
6. Harden and Segment Virtualization Infrastructure
Restrict access to hypervisor management, segment networks so one breach can’t reach everything, and patch virtualization platforms promptly.
7. Back Up and Practice Recovery
Keep isolated, tested backups of critical systems, and rehearse a full restore. Recovery speed decides how long operations stay down.
8. Plan and Rehearse Your Incident Response
Define who decides, who communicates, and how you operate manually when systems are offline. Run tabletop exercises that include a ransomware scenario.
Quick Checklist: Are You Protected Against a Similar Attack?
| Area | Question to Ask |
|---|---|
| Help desk | Do we verify identity before every reset? |
| Access | Is MFA phishing-resistant for admins? |
| Identity | Who has domain admin rights, and why? |
| Vendors | What can third parties access? |
| Detection | Would we spot weeks of hidden activity? |
| Recovery | Have we tested restoring from backups? |
| Training | Do staff know how to spot impersonation calls? |
How Xcitium Helps Defend Against Attacks Like This
No product alone would have stopped every step of the Marks & Spencer cyber attack, but layered defenses make each step harder. Xcitium’s EDR and Managed EDR provide continuous monitoring and expert response, while ZeroDwell Technology contains unknown files so they can’t do damage. Managed ITDR targets identity-based threats, and phishing simulation and security awareness training prepare your people for the impersonation tactics seen here. Vulnerability assessments and penetration testing help you find weak points before attackers do.
Frequently Asked Questions
What happened in the Marks & Spencer cyber attack?
It was a ransomware attack in April 2025 that disrupted contactless payments and click-and-collect, forced online orders to stop for weeks, and led to stolen customer data. Attackers are believed to have been in the network for about two months beforehand.
Who was responsible for the M&S cyber attack?
Sources linked it to Scattered Spider, working with the DragonForce ransomware operation. Police arrested four suspects in July 2025, but arrests are not convictions.
How much did the Marks & Spencer cyber attack cost?
M&S estimated about £300 million in lost operating profit.
How did hackers get into M&S?
Reports point to social engineering, with attackers reportedly impersonating an employee to get a third-party IT contractor to reset credentials. They then used stolen admin credentials and remote tools to move through the network.
How can businesses prevent a similar attack?
Verify identities before password resets, use phishing-resistant MFA, limit admin rights, monitor with EDR, manage vendor access, segment critical systems, and keep tested offline backups.
Conclusion
The Marks & Spencer cyber attack shows that even large, well-resourced organizations can be brought down by a chain of small weaknesses: a convincing phone call, over-privileged accounts, unmonitored access, and flat infrastructure. The good news is that each link in that chain can be strengthened. Start with identity verification, privilege control, and continuous monitoring, and rehearse your recovery before you need it.
Want to know how your defenses would hold up? Request a demo with Xcitium today and see how to protect your endpoints, identities, and people.
Please give us a star rating based on your experience.
(24 votes, average: 2.25 out of 5, rated)
