Kevin BeaumontApr 22
Marks and Spencer dealing with.. ransomware? https://infosec.exchange/@d4rkshell/114381922723370326
d4rkshell :verified: (@d4rkshell@infosec.exchange)

Attached: 1 image Cyber incident reported by Marks and Spencer

Infosec Exchange
Show threadKevin BeaumontApr 24
M&S still dealing with a major cyber incident https://www.bbc.co.uk/news/articles/cly802x1jz5o
Cyber attack causes further chaos for shoppers at M&S

Customers have reported problems with click and collect orders as well as card and contactless payments.

BBC News
Show threadKevin BeaumontApr 25
It looks like M&S may be in serious operational trouble, more services being contained. https://www.bbc.com/news/articles/cdxnkg7rln2o
M&S stops online orders and issues refunds after cyber attack

The firm has stopped taking orders on its website and apps, including for food and clothes.

Show threadKevin BeaumontApr 25
M&S use Palo-Alto GlobalProtect for VPN, they took all the endpoints offline days ago (usually first stage containment for ransomware/extortion groups).
Show threadKevin BeaumontApr 25

So from looking through their external services, it looks like M&S started containment between Sunday 20th-Tuesday 22nd of April.

They had inbound network activity from IPs associated with crimeware groups, but difficult to know which one due to shared infrastructure.

Show threadKevin BeaumontApr 26

The Sunday Times today back up my toot about VPN access to M&S being shut down, saying a source at the company says remote access has been “scaled back”: https://www.thetimes.com/business-money/companies/article/marks-and-spencer-shuts-out-wfh-staff-after-cyberattack-q2wwcjzl3

Additionally, the print version of The Telegraph says it is ransomware, citing somebody involved in containment. They say they believe they have locked the threat actor out of the network now and are working on restoration.

Marks & Spencer shuts out WFH staff after cyberattack

M&S cuts off remote access to some of its IT systems to stop spread of suspected ‘ransomware’ cyberattack that has disrupted online orders and hit M&S’s shares

The Sunday Times
Show threadKevin BeaumontApr 28
Marks and Spencer have told agency staff not to show up to shifts at its main distribution centre due to the ongoing cyber incident https://news.sky.com/story/flatplan-13357434
M&S tells agency workers to stay at home after cyberattack

Sky
Show threadKevin BeaumontApr 28
I just checked in on M&S, a large part of their network is still contained - they're on about day 9. Their GlobalProtect and another VPN are also still offline.
Rob PomeroyApr 30
Show threadKevin Beaumont

Marks and Spencer cyber incident = ransomware.

It's DragonForce ransomware cartel, they have encrypted their VMware ESXi clusters. Lines up with network traffic I saw.

https://www.bleepingcomputer.com/news/security/marks-and-spencer-breach-linked-to-scattered-spider-ransomware-attack/

Marks & Spencer breach linked to Scattered Spider ransomware attack

Ongoing outages at British retail giant Marks & Spencer are caused by a ransomware attack believed to be conducted by a hacking collective known as "Scattered Spider" BleepingComputer has learned from multiple sources.

BleepingComputer
Apr 28 at 8:32pmWeb
Show threadKevin BeaumontApr 28
DragonForce's portal is currently offline, but their payment negotiation system is still online and chats ongoing.   
Show threadKevin BeaumontApr 28

For the record, I think M&S external response so far has been pretty good. They probably should say ransomware themselves publicly, as it's their chance to control the narrative.

I dunno how that level of incident detail got out to media but I'm going to guess intelligence sharing, those circles are basically megaphones. The CISA model with Boeing for CitrixBleed worked better where CISA released findings, made it technical, boring and actionable.

Show threadKevin BeaumontApr 29
DragonForce's portal is still offline. Their chats and negotiations are being monitored now.
Show threadKevin BeaumontApr 29

Some M&S stores are apparently having stock problems. I popped around to my local M&S yesterday and asked - they said there's no forecasting system, so they are getting random goods delivery rather than stock refills.

https://www.bbc.co.uk/news/articles/cy489zelvx2o

Some M&S stores left with empty shelves after cyber attack

The BBC understands M&S's operations will take until the end of the week before beginning to return to normal.

BBC News
Show threadKevin BeaumontApr 29
Bloomberg confirm DragonForce ransomware at Marks and Spencer https://www.bloomberg.com/news/articles/2025-04-29/ransomware-hack-said-to-be-cause-of-marks-spencer-outages
Show threadKevin BeaumontApr 29
Show threadKevin BeaumontMay 1
M&S have stopped all recruitment and pulled open positions https://www.standard.co.uk/business/business-news/m-s-stops-hiring-after-systems-taken-offline-due-to-cyber-attack-b1225414.html
M&S stops hiring after systems taken offline due to cyber attack

The company confirmed on Thursday that it has pulled all online job adverts.

Evening Standard
Show threadKevin BeaumontMay 1
Time to do the four yearly patching cycle.
Show threadKevin BeaumontMay 1
The Marks and Spencer and Co-op cyber incident situation is continuing to dominate TV headlines in the UK.
Show threadKevin BeaumontMay 1
There's a bit more details on things broken at M&S on backend in this report.
Show threadAlan Miller  🇺🇦May 2
@GossiTheDog the US will get to see some of this in a few months as companies run into packaging supply issues.
Show threadSimonoidMay 1
@GossiTheDog patching like mad as opposed to...? What? Technical debt and "it will never happen to us"?
Show threadAndy PriceMay 1
@GossiTheDog I knew I should've spent my Christmas vouchers earlier...
Show threadBen HardillMay 1
@GossiTheDog so they didn't ask a new recruit how fat Kim Jung Ill was?
Show threadCaliApr 29
@GossiTheDog third party supplier breach?
Show threadpogseeApr 29
@GossiTheDog jeez, hope they make it through the fire and flames
Show threadOobleckApr 30
@pogsee @GossiTheDog This is the joke I was hoping for.
Show threadRiley S. FaelanApr 29
@GossiTheDog #infosec
Show threadExpertenkommision CyberunfallApr 29

@GossiTheDog

randomized delivery queues, must feel like 1970ies in the gdr, where you never knew if there would be bread or plates for purchase after you waited 3h in the queue in front of the bakery.

Show threadJason StuartApr 29
@GossiTheDog I would bet that a long time ago, some IT person was screaming at management during a "risk assessment" meeting that significant outages could cause this and the number crunchers said, "the business accepts the risk, so no need to bolster the itsec budget."
Show threadAndrew DeaconApr 29
@GossiTheDog I assume that this is not THE Dragonforce of very loud and fast guitar solos, fast drumming(very fast drumming) and songs about war etc, A fine and wonderful band
Show threadBrian ClarkApr 28
@GossiTheDog Nice turn of a phrase there. “technical, boring and actionable” should apply to all things cybersecurity.
Show threadh3artbl33d  Apr 28

@GossiTheDog

Through the fire and flames!

Show threadRairii   Apr 28
@GossiTheDog through the marks and spencers
Show threadTryst 🏴󠁧󠁢󠁷󠁬󠁳󠁿  Apr 28
@GossiTheDog Unexpected cryptography in the virtualisation area