M&S and Co-op: how impersonating staff to the help desk cost hundreds of millions

Two of Britain's best-known retailers were brought to a standstill in spring 2025. According to reports, the way in was not a zero-day exploit. It was a convincing request to reset a password.

What happened

According to evidence M&S chairman Archie Norman gave to MPs, attackers first got into Marks & Spencer's systems on 17 April 2025, and the company realised it on Easter Saturday, 19 April. M&S went public on 22 April and suspended all online orders on 25 April. They did not resume until 10 June, after 46 days.

M&S estimated the hit to operating profit at around £300 million before mitigation. Its first-half profit fell to £3.4 million from £391.1 million a year earlier, partly offset by a £100 million insurance payment. Customer data such as phone numbers, home addresses and dates of birth may have been taken, though not card details or passwords.

The Co-op was attacked at around the same time. It shut systems down before ransomware could be deployed, but its chief executive later said data belonging to all 6.5 million members had been taken. The Co-op reported £206 million in lost sales.

On 10 July 2025, the National Crime Agency arrested four people, aged between 17 and 20, on suspicion of offences including Computer Misuse Act offences and blackmail. Media reports attributed the attacks to the group known as Scattered Spider using DragonForce ransomware. The NCA did not name a group.

How the attack worked

Reuters, citing BleepingComputer, reported that both attacks began with attackers impersonating employees to IT help desks in order to get passwords reset. Norman told Parliament that entry involved "sophisticated impersonation" and "also involved a third party". The outsourced service desk provider has said its own inquiry found no indicators of compromise in its network.

Once an attacker controls a real employee's account with a fresh password, many security controls see a legitimate user.

Why it matters for your organisation

Most organisations rely on the same model: a small internal IT team or an outsourced provider resets passwords and MFA for busy people who call in a hurry. If the only check is a name and a confident voice, that process is a door.

What to do now

1. Harden password and MFA resets. Require a verification step attackers cannot research, such as a call-back to a registered number or approval by a named manager.
2. Treat MFA resets as high risk. Log them, alert on them and review them, especially for partners and administrators.
3. Check your outsourced IT provider's process and write your verification requirements into the contract.
4. Practise the shutdown decision. The Co-op limited damage by disconnecting systems quickly. Know who can make that call in your organisation.
5. Train staff on the reverse scenario: attackers calling employees while posing as the help desk.

How Blacknote helps

We review help desk and identity processes, test them with realistic social engineering scenarios, and train staff so that a phone call is never enough to take over an account.

Sources

1. UK Parliament Business and Trade Committee: oral evidence, 8 July 2025
2. Business Insurance: M&S, Co-op cyberattackers duped IT help desks into resetting passwords (Reuters)
3. Retail Systems: Marks & Spencer resumes online orders after 46-day cyber attack hiatus
4. The Record: Marks & Spencer profits wiped out by cyberattack
5. BleepingComputer: Four arrested in UK over M&S, Co-op, Harrods cyberattacks
6. The Register: Co-op confirms data of 6.5 million members stolen
7. Retail Gazette: Co-op interim results