M&S Confirms Social Engineering Led to Massive Ransomware Attack

In April 2025, Marks & Spencer (M&S), the renowned British retailer, faced a significant cyberattack that disrupted its operations and compromised sensitive customer data. The attack, attributed to the DragonForce ransomware group, was initiated through sophisticated social engineering tactics targeting a third-party contractor. This breach highlights the evolving nature of cyber threats and the critical importance of robust cybersecurity measures.

The Attack Unfolds

The cyberattack began when attackers exploited human vulnerabilities within M&S’s supply chain. They targeted a third-party contractor, Tata Consultancy Services (TCS), which provided IT support to M&S. By impersonating an M&S employee, the attackers convinced TCS’s service desk to reset an employee’s password, granting them unauthorized access to M&S’s network. This method of social engineering bypassed M&S’s digital defenses, allowing the attackers to infiltrate the system without exploiting technical weaknesses.

Once inside, the attackers deployed the DragonForce ransomware, encrypting critical systems and data. This action led to the suspension of online orders and disrupted in-store operations, including contactless payments and loyalty card usage. The breach exposed sensitive customer information, including names, addresses, email addresses, phone numbers, dates of birth, and online order history. Importantly, M&S emphasized that no payment information was compromised during the attack.

Dont let data threats slow you downTrueNAS offers enterprise-level protection.

Financial and Operational Impact

The repercussions of the cyberattack were immediate and severe. M&S estimated a potential £300 million loss in operating profits due to the disruption. The company’s market value also took a significant hit, with reports indicating a £750 million decrease following the incident. The breach not only affected M&S’s financial standing but also eroded customer trust, as evidenced by the class action lawsuit filed in response to the data exposure.

Response and Recovery Efforts

In response to the attack, M&S took swift action to mitigate the damage and restore services. The company halted online sales and worked diligently to secure its systems. Recovery efforts were ongoing, with full restoration expected by July 2025. M&S also notified customers about the breach, urging them to reset their passwords and remain vigilant against potential phishing attempts.

Lessons Learned and Industry Implications

The M&S cyberattack serves as a stark reminder of the vulnerabilities inherent in supply chain relationships. It underscores the necessity for organizations to extend their cybersecurity protocols to include third-party vendors. Regular vetting, comprehensive training, and stringent access controls are essential to mitigate risks associated with external partners.

Furthermore, the incident highlights the critical role of human factors in cybersecurity breaches. Social engineering tactics, such as phishing and impersonation, remain potent tools for cybercriminals. Organizations must invest in continuous employee education and awareness programs to recognize and respond to such threats effectively.

Conclusion

The M&S cyberattack exemplifies the complex and evolving nature of cyber threats facing modern businesses. It underscores the imperative for organizations to adopt a holistic approach to cybersecurity, encompassing robust technical defenses, comprehensive employee training, and vigilant third-party risk management. By learning from such incidents, companies can bolster their resilience against future cyber threats and safeguard their operations and customer trust.