# Marks & Spencer ransomware (Scattered Spider / DragonForce) halts online orders for 46 days · pwn.watch

> Scattered Spider got in through social engineering of a third-party IT provider and encrypted M&S's VMware ESXi hosts with DragonForce ransomware over Easter 2025. Contactless payments, Click & Collect and online ordering broke; online orders were paused from April 25 to June 10. M&S put the hit at about £300M of operating profit.

Page: https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025 · generated 2026-10-22T21:08:49.695Z

## Status
- Severity: critical · status: closed · patch: no-fix-needed
- Product: Marks & Spencer (retail IT, VMware ESXi)
- Started: 2025-04-22 · closed: 2025-06-10
- Affected: n/a

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025/feed.xml
- JSON Feed: https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025.json
- This file: https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025/llms.txt

## Updates (newest first)
- 2025-06-10: Online clothing orders resume after 46 days (https://www.reuters.com/business/retail-consumer/uks-ms-resumes-online-orders-following-cyber-incident-2025-06-10/)
- 2025-05-21: M&S estimates about £300M cost; disruption to last into July (https://www.reuters.com/business/media-telecom/britains-ms-says-cyberattack-cost-400-million-2025-05-21/)
- 2025-04-29: Attack linked to Scattered Spider and DragonForce ransomware on ESXi (https://www.bleepingcomputer.com/news/security/marks-and-spencer-breach-linked-to-scattered-spider-ransomware-attack/)
- 2025-04-25: M&S pauses online orders after a cyber incident (https://www.reuters.com/business/retail-consumer/britains-ms-pauses-some-online-orders-after-cyber-incident-2025-04-25/)

## Fix brief
# Security brief: Marks & Spencer ransomware (Scattered Spider / DragonForce) halts online orders for 46 days

Source: https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025 · status: closed (closed Jun 10, 2025) · severity: critical · updated Jun 10, 2025

## Patch status
**NO FIX NEEDED: no action on your side beyond verification.**

## What it is
Scattered Spider got in through social engineering of a third-party IT provider and encrypted M&S's VMware ESXi hosts with DragonForce ransomware over Easter 2025. Contactless payments, Click & Collect and online ordering broke; online orders were paused from April 25 to June 10. M&S put the hit at about £300M of operating profit.

Severity detail: Ransomware; weeks of retail disruption; customer data stolen

- Product: Marks & Spencer (retail IT, VMware ESXi)

## Affected versions
- n/a

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Latest updates
- Jun 10, 2025: Online clothing orders resume after 46 days
- May 21, 2025: M&S estimates about £300M cost; disruption to last into July
- Apr 29, 2025: Attack linked to Scattered Spider and DragonForce ransomware on ESXi
- Apr 25, 2025: M&S pauses online orders after a cyber incident

## Write-ups & news
- [Britain's M&S stops taking online orders after cyber attack](https://www.reuters.com/business/retail-consumer/britains-ms-pauses-some-online-orders-after-cyber-incident-2025-04-25/)
- [Marks & Spencer breach linked to Scattered Spider ransomware attack](https://www.bleepingcomputer.com/news/security/marks-and-spencer-breach-linked-to-scattered-spider-ransomware-attack/)
- [M&S confirms social engineering led to massive ransomware attack](https://www.bleepingcomputer.com/news/security/mands-confirms-social-engineering-led-to-massive-ransomware-attack/)
- [M&S' $400 million cyberattack upheaval to linger into July](https://www.reuters.com/business/media-telecom/britains-ms-says-cyberattack-cost-400-million-2025-05-21/)
- [After 46-day cyberattack pause, M&S resumes online orders](https://www.reuters.com/business/retail-consumer/uks-ms-resumes-online-orders-following-cyber-incident-2025-06-10/)

## Caveats
startedAt is when M&S first disclosed the incident (2025-04-22, from memory); the attack began over the Easter weekend. The Apr 29 attribution date is approximate.

---
Machine-readable: https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.