M&S, Co-op, and Harrods 2025: Scattered Spider, a Phone Call to the Help Desk, and £440 Million

Between April 22 and May 1, 2025, three of the most recognizable retailers in Britain — Marks & Spencer, the Co-operative Group, and Harrods — disclosed cyber incidents within nine days of each other. The Cyber Monitoring Centre later classified the M&S and Co-op events as a single combined cyber event with a financial impact between £270 million and £440 million.

The access method was the same at each: a phone call to an outsourced IT help desk, an English-speaking caller with a plausible story about a locked-out employee, and a multi-factor authentication reset granted to an attacker. M&S lost online ordering for six weeks. The tradecraft on display in April 2025 is the same tradecraft that reached Apollo Global Management in July 2026.

Marks & Spencer. Customers reported disruption to Click & Collect and in-store returns beginning April 21, 2025. M&S confirmed a cyber incident on April 22. Within days the retailer suspended all online and telephone orders and sent warehouse staff home as inventory management systems went down. On May 7 the company confirmed customer data had been accessed — names, email addresses, dates of birth, and order history. Passwords and payment card details were not compromised. Online ordering resumed in stages beginning June 10, after 46 days. M&S later quantified the impact at roughly £300 million.

Co-operative Group. Co-op detected suspicious activity on April 30 and proactively shut down critical IT systems across its retail and banking operations to contain the intrusion. The shutdown was a defensive choice made under pressure, and it worked: the containment limited the damage while imposing significant operational cost.

Harrods. On May 1 the luxury retailer confirmed it had been targeted and had restricted internet access across store facilities as a precaution. Harrods stated the attack was contained early with no customer data accessed and no interruption to store or online operations.

In June 2025 the Cyber Monitoring Centre — the UK non-profit established by the insurance industry to categorize major cyber events — assessed the M&S and Co-op incidents as a single combined cyber event, citing one threat actor claiming responsibility for both, the close timing, and matching tactics. It classified the event as Category 2 systemic, with a total financial impact estimated between £270 million and £440 million. Harrods was excluded from the assessment for lack of sufficient information about cause and impact.

On July 10, 2025, the National Crime Agency arrested four individuals — a 20-year-old woman, two 19-year-old men, and a 17-year-old — on suspicion of Computer Misuse Act offences, blackmail, money laundering, and participation in an organised crime group.

The vector was help desk social engineering, executed by phone.

The attacker calls the target's IT service desk claiming to be an employee — typically one with enough seniority to justify urgency and enough public footprint that name, department, and reporting line are recoverable from LinkedIn. The story involves a locked account, a lost phone, or a failed MFA enrollment. The caller is fluent, patient, and unremarkable. The help desk agent, whose job is to restore access quickly, resets multi-factor authentication on the account.

At M&S, the help desk was operated by an outsourced IT services provider. Reporting indicated the account whose MFA was reset held privileged access. From there the attackers reached domain administrator, the customer database, and the operational capability to deploy ransomware.

Two structural observations. First, the identity provider was never defeated. M&S's identity management was strong enough that a direct technical attack would have been substantial work. The help desk was reachable by anyone with a phone. Second, outsourcing the help desk outsourced the verification standard without transferring the consequence. The provider's agents were following their own procedures. Those procedures were not built to withstand a targeted, well-researched impersonation of a specific employee.

This is the same attack chain documented in Cloudskope's technical analysis of the 2026 Wall Street wave: How a Phone Call Beats MFA.

For sponsors with retail, consumer, or any operationally-dependent business in the portfolio, this event is the clearest available demonstration that cyber risk is operational risk, not an IT line item.

M&S did not lose data and continue trading. It lost the ability to sell online for six weeks during a period of otherwise strong growth. Co-op shut down critical systems proactively and absorbed the operational cost of that decision. The financial impact was denominated in lost trading, not in remediation cost or regulatory penalty.

The diligence implication is direct. A target's cyber exposure should be assessed against a business-interruption scenario, not only a data-breach scenario. The questions: how long could this company not transact? What is the daily gross margin at risk? Does the cyber insurance policy cover business interruption from a cyber event, and at what limit against that daily figure?

The second implication is help desk verification as a diligence line item. Any target using an outsourced IT provider with credential reset authority has handed the keys to a third party whose verification standard the target likely has never audited. That belongs in cyber due diligence, and it is cheap to check.