A Legacy Under Siege

For over 140 years, Marks & Spencer (M&S) has been a name synonymous with quality, trust, and British retail excellence. Founded in 1884 in Leeds, England, the company started as a small penny bazaar, selling affordable household goods. It quickly grew into a retail powerhouse, known for its high-quality clothing, luxury food offerings, and innovation in consumer shopping.

With over 1,400 stores worldwide, M&S has remained a pillar of British retail, adapting to changing times and consumer trends. But on May 25, 2025, that pillar was shaken to its core—an enemy it never saw coming tore through its defenses and left devastation in its wake.

A Timeline of Chaos

It began like any other day. The morning rush of customers placing online orders, the seamless hum of transactions, the quiet confidence of a retail empire. But on the night of May 25, everything changed.

Marks & Spencer was hit by DragonForce ransomware, a sophisticated cyberattack that infiltrated its systems with surgical precision.

At first, it was just a few glitches—payments stalling, orders failing. Then, as the hours dragged on, the situation spiraled into catastrophe. Entire click-and-collect services shut down. The company's website became inaccessible, leaving frustrated customers in the dark. By midday, Marks & Spencer realized the chilling truth: they weren’t just under attack. They were being held hostage.

What Was Stolen?

The attackers, suspected to be Scattered Spider, didn’t stop at disruption. They ripped through security protocols, accessing the company’s Windows domain’s NTDS.dit file—a vault of password hashes that gave them unfiltered access to M&S’s digital infrastructure.

But the real nightmare? Customer data.  
Personal details, including names, email addresses, postal addresses, and even birthdates, fell into enemy hands. The integrity of the brand—built over a century of trust—was shattered in a matter of hours.

Who Are Scattered Spider?

Scattered Spider, also known as UNC3944, is a notorious hacking group composed of English-speaking cybercriminals, many believed to be based in the UK and the U.S..

The group first gained notoriety in 2023, when they breached casino giants Caesars Entertainment and MGM Resorts International. Caesars reportedly paid a $15 million (€13.8 million) ransom to recover its systems.

Scattered Spider specializes in social engineering, using SIM swapping, MFA fatigue attacks, and phishing to infiltrate corporate networks. They have deep knowledge of cloud platforms like Microsoft Azure, Google Workspace, and AWS, allowing them to bypass security measures with frightening efficiency.

The True Cost of the Marks & Spencer Cyberattack: A Financial Breakdown

Direct Financial Losses

Marks & Spencer has already projected a £300 million (€350 million) hit to its operating profits due to the cyberattack. This includes:

• Lost sales: The company is losing £40 million (€47 million) per week in revenue due to halted online operations.

• Stock shortages & food waste: Disruptions in logistics have led to increased waste and stock loss, particularly in the Food segment.

• Operational disruptions: Manual processing has replaced automated systems, increasing labor costs.

   

Ransom Payment

While Marks & Spencer has not disclosed whether it paid a ransom, previous cases suggest potential costs:

• Caesars Entertainment (2023) paid $15 million (€13.8 million) to Scattered Spider to recover its systems.

• Colonial Pipeline (2021) paid $4.4 million (€4 million) to DarkSide hackers.

• Average ransom demands for large corporations range between £10 million (€11.7 million) and £50 million (€58.5 million).

   

Data Restoration & IT Recovery

Recovering from a ransomware attack requires extensive data restoration, security upgrades, and forensic investigations:

• British Library (2023) spent £6-7 million (€7-8.2 million) recovering from a ransomware attack.

• Marks & Spencer’s IT recovery is expected to cost £50-80 million (€58-94 million), including system upgrades and cybersecurity enhancements.

  

  
   

Legal Costs & Regulatory Fines

• GDPR fines: If customer data was compromised, Marks & Spencer could face fines up to 4% of annual revenue, potentially £100 million (€117 million).

• Class-action lawsuits: Legal fees and settlements could exceed £50 million (€58.5 million), based on similar cases.

•  

Reputation Damage & Long-Term Impact

• Brand trust decline: Analysts predict millions in lost sales due to damaged consumer confidence.

• Stock market impact: Marks & Spencer’s shares have already dropped 10% since the attack.

• Projected revenue loss: If consumer trust erodes further, annual revenue could decline by £500 million (€585 million) over the next two years.

Total Estimated Cost

Based on previous cases and current projections, the total financial impact of the Marks & Spencer cyberattack could range between £500 million (€585 million) and £1 billion (€1.17 billion).

How Cy-Napea® Could Have Saved Marks & Spencer from Cyber Catastrophe

The First Line of Defense: Cybersecurity Awareness Training

Before cybercriminals ever breach a system, they exploit human error. Scattered Spider is infamous for social engineering, tricking employees into revealing credentials through phishing emails, fake IT calls, and fraudulent login requests.

With Cy-Napea®’s Cybersecurity Awareness Training, Marks & Spencer employees would have been equipped to recognize and stop these threats:

• Phishing simulations would have trained staff to spot fraudulent emails before clicking malicious links.

• Social engineering awareness would have prevented employees from falling for fake IT support scams.

• Real-world attack scenarios would have ensured staff knew how to respond to suspicious activity.

By eliminating human vulnerabilities, Cy-Napea® could have stopped the attack before it even began.

The Second Line of Defense: Advanced Email Security

Even with trained employees, attackers still try to bypass defenses. Cy-Napea®’s AI-powered email security would have:

• Blocked phishing emails before they reached inboxes.

• Flagged impersonation attempts, preventing attackers from posing as IT staff.

• Analyzed email behavior patterns, stopping fraudulent login requests.

With email security in place, Marks & Spencer’s first breach point could have been neutralized instantly.

The Third Line of Defense: EDR/XDR/MDR Solutions

Once inside the network, Scattered Spider deployed DragonForce ransomware, encrypting Marks & Spencer’s systems and stealing password hashes from the Windows domain’s NTDS.dit file.

Cy-Napea®’s EDR/XDR/MDR solutions would have detected and neutralized the attack before it escalated:

• Endpoint monitoring would have flagged unusual activity, such as mass file encryption.

• Automated response systems would have isolated infected machines, preventing ransomware spread.

• Threat hunting AI would have identified the breach early, stopping attackers before they could exfiltrate sensitive data.

The Last Line of Defense: Advanced Backup & One-Click Recovery

Despite all security measures, some attacks succeed. But with Cy-Napea®’s continuous data backup and instant recovery, Marks & Spencer could have restored operations within hours, avoiding weeks of disruption.

• Real-time backups would have ensured zero data loss, even during an attack.

• One-click recovery would have restored systems instantly, eliminating downtime.

• Immutable storage would have prevented attackers from tampering with backups, ensuring data integrity.

Resources Saved: A Financial Breakdown

Had Marks & Spencer implemented Cy-Napea®’s full security suite, the company could have saved hundreds of millions:

• Ransom payment avoided: Potential savings of £10-50 million (€11.7-58.5 million).

• Operational losses minimized: Instead of £300 million (€350 million), downtime costs could have been under £50 million (€58.5 million).

• Legal fees reduced: GDPR fines and lawsuits could have been cut by 70%, saving £100 million (€117 million).

• Reputation damage controlled: With rapid recovery, customer trust loss would have been minimal, preventing £500 million (€585 million) in future revenue decline.

A Future-Proof Cybersecurity Strategy

With Cy-Napea®’s multi-layered security, Marks & Spencer could have avoided ransom payments, minimized financial losses, and restored operations without disruption. In an era where cyber threats evolve daily, proactive defense is the only way forward.