M&S Reportedly Hacked Using Third-Party Credentials

British retailer Marks & Spencer was reportedly compromised by cybercrime group Scattered Spider using stolen employee credentials from a third-party IT company.

See Also: Top 10 Technical Predictions for 2025

Citing an unidentified source, Reuters on Monday reported hackers used the M&S login credentials of two Tata Consulting Services employees. TCS is a Mumbai-based IT consultancy firm that handles the British retailer’s digital operations across its supply chain, stores and merchandising.

M&S disclosed the hack in April, which security experts attributed to cybercrime group Scattered Spider. The hacking group is suspected to have deployed DragonForce ransomware on the company’s VMware ESXi server (see: Scattered Spider Linked to Marks & Spencer Hack).

The group stole personal data of customers, including their names, addresses and order history. M&S in an April update, said it has paused taking orders through its websites and apps.

Neither TCS nor Marks and Spencer responded to emails seeking more details on the hack.

The retailer detected the hack only 52 hours after the initial compromise, The Times reported. It took security defenders five days to prevent further network intrusion by the hackers.

Following the hack, the retailer recorded nearly a 14% slump in its share value worth 1.5 billion pounds. The CEO of the company is also facing a pay cut of 1.1 million pounds.

The retailer could claim up to 100 million pounds from its cyber insurers, the Financial Times reported.

The company could face further legal troubles, with Thompsons Solicitors stating that the firm filed a class action claim against M&S on behalf of the retailer’s Scottish customers for poorly securing its customer data and likely exposing them to scams.

“We have been inundated by Scots M&S clients who have been caught up in this online heist and are contacting Thompsons given our experience in this area. I think this will be the biggest data theft case we have ever been involved in,” Patrick McGuire, a senior partner at Thompsons Solicitors told the Daily Record.

In addition to M&S, hackers in recent months targeted Co-op and London-based Harrods, causing service and supply chain disruptions (see: NCSC Recommends Security Measures Amid UK Retailer Hacks)./p>

On Tuesday, Peter Green Chilled, a major U.K. supermarket supplier, was hit by ransomware.

These attacks depict a “troubling trend” of hackers shifting from “data theft to outright operational disruption,” Raghu Nandakumara said, head of industry solutions at security firm Illumio.

“Ransomware is proving more damaging than isolated data breaches, with many businesses facing major downtime, reputational harm and financial loss. Now more than ever, retailers must prioritize operational resilience and adopt controls that can prevent attackers from reaching their most vital systems, “Nandakumara added.