Overview

• Hackers using DragonForce ransomware and the account of a Tata Consultancy Services employee sent a taunting email to CEO Stuart Machin on April 23, claiming to have encrypted all M&S servers.
• The gloating message included a dark net link for ransom negotiations and threatened to leak or sell the private data of millions of customers.
• Marks & Spencer has confirmed theft of customers’ personal data, raising expert warnings about potential scams targeting its 9.4 million active online users.
• The breach has cost M&S an estimated £300 million, forced a suspension of online orders since late April and is expected to disrupt the retailer’s operations into July.
• Security researchers say the incident, involving DragonForce’s affiliate model and the Scattered Spider group, mirrors a wave of ransomware attacks on UK retailers including the Co-op.