ClosedCriticalNo fix needed
Marks & Spencer ransomware (Scattered Spider / DragonForce) halts online orders for 46 days
Marks & Spencer (retail IT, VMware ESXi)
Scattered Spider got in through social engineering of a third-party IT provider and encrypted M&S's VMware ESXi hosts with DragonForce ransomware over Easter 2025. Contactless payments, Click & Collect and online ordering broke; online orders were paused from April 25 to June 10. M&S put the hit at about £300M of operating profit.
Why this severity: Ransomware; weeks of retail disruption; customer data stolen
- Started
- Apr 22, 2025
- Closed
- Jun 10, 2025
Affected
- n/a
Fixed in
No fixed release yet
Timeline4
News & write-ups5
- Britain's M&S stops taking online orders after cyber attackReuters · Apr 25, 2025
- Marks & Spencer breach linked to Scattered Spider ransomware attackBleepingComputer
- M&S confirms social engineering led to massive ransomware attackBleepingComputer
- M&S' $400 million cyberattack upheaval to linger into JulyReuters · May 21, 2025
- After 46-day cyberattack pause, M&S resumes online ordersReuters · Jun 10, 2025
Notes & caveats
startedAt is when M&S first disclosed the incident (2025-04-22, from memory); the attack began over the Easter weekend. The Apr 29 attribution date is approximate.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
