Marks & Spencer and the Co-Op have suffered a brutal breach in the recent few weeks, the full scale of which is still unknown.
It should be clear that whilst the attack has been attributed to SCATTERED SPIDER, a group made infamous for their breach of the MGM casinos in Las Vegas in September 2023[1], a lot of speculation has been made about the exact attack methodology they used to gain a foothold in, and ultimately compromise Marks & Spencer, but no real information has been shared about the exact methodology to date. In the past, this group have been known to use several social engineering tactics to trick helpdesks, or to use sim swapping to compromise MFA, but it is not yet known what they did in this case.
What is known is that the breach has resulted in significant share price drops, loss of earnings from online ordering systems (with some estimates placing this at up to £3.5m per day[2]), and tertiary impacts to third parties Marks & Spencer do business with. Anonymised media report suggest that Marks and Spencer’s incident response plan was inadequate for the extent of the breach they have suffered, and indications are that customer information may have been compromised in the breach. The full cost of the breach is yet to be fully assessed, but recent media reports suggest the insurance claim could come in at £100 million[3]
Neither Marks & Spencer or the Co-Op were thought to be overly lax in their cybersecurity however, securing an enterprise the size of these organisations, with the number of staff they employ and contract with, the complexity of their supply chains, is exceptionally challenging.
Whilst it is far too early to conduct a root cause analysis of the breach and a lessons learned exercise, all organisations should sit-up and take note. They should be asking themselves when they were last properly assessed with a simulated threat actor attack (a red team), or even when they last fully exercised their incident response playbooks (not just a tabletop) for an attack of this magnitude but invoking it and testing disaster recovery.
Prism Infosec understands these challenges and complexities, and we can help, not just test your plans but also help clients improve them and support them in the event of a breach.
[1] MGM cyber attack: How a phone call may have led to the ongoing hack | Vox
[2] Empty shelves at M&S as store faces losses of ‘millions each day’ in wake of cyber attack | ITV News