Overview

• Marks & Spencer's online and in-store services remain disrupted following a ransomware attack over the Easter weekend, reportedly linked to Scattered Spider.
• Authorities, including the Metropolitan Police cyber crime unit, National Cyber Security Centre, and Information Commissioner’s Office, are actively investigating the attack, with no arrests yet made.
• Scattered Spider, a loosely affiliated group of English-speaking hackers, is known for using phishing, social engineering, and ransomware-as-a-service to target corporations.
• The group has previously been tied to high-profile cyberattacks, including incidents at MGM Resorts and Caesars Entertainment in 2023, and is suspected of stealing millions in cryptocurrency.
• Tyler Robert Buchanan, alleged leader of the group, was extradited from Spain to the US in April 2025 to face charges related to earlier phishing schemes.