{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T19:58:23.236Z",
  "tag": {
    "id": "dragonforce",
    "label": "DragonForce",
    "isStack": false,
    "url": "https://pwn.watch/t/dragonforce",
    "feed": "https://pwn.watch/t/dragonforce/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "marks-and-spencer-ransomware-scattered-spider-april-2025",
      "title": "Marks & Spencer ransomware (Scattered Spider / DragonForce) halts online orders for 46 days",
      "url": "https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025",
      "json": "https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "no-fix-needed",
      "product": "Marks & Spencer (retail IT, VMware ESXi)",
      "tags": [
        "marks-and-spencer",
        "scattered-spider",
        "dragonforce",
        "vmware",
        "ransomware"
      ],
      "cveIds": [],
      "affectedVersions": [
        "n/a"
      ],
      "fixedVersions": [],
      "startedAt": "2025-04-22",
      "closedAt": "2025-06-10",
      "updatedAt": "2025-06-10",
      "summary": "Scattered Spider got in through social engineering of a third-party IT provider and encrypted M&S's VMware ESXi hosts with DragonForce ransomware over Easter 2025. Contactless payments, Click & Collect and online ordering broke; online orders were paused from April 25 to June 10. M&S put the hit at about £300M of operating profit.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "marks-and-spencer-ransomware-scattered-spider-april-2025",
      "incidentTitle": "Marks & Spencer ransomware (Scattered Spider / DragonForce) halts online orders for 46 days",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-06-10",
      "title": "Online clothing orders resume after 46 days",
      "body": null,
      "sourceUrl": "https://www.reuters.com/business/retail-consumer/uks-ms-resumes-online-orders-following-cyber-incident-2025-06-10/",
      "url": "https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025"
    },
    {
      "incident": "marks-and-spencer-ransomware-scattered-spider-april-2025",
      "incidentTitle": "Marks & Spencer ransomware (Scattered Spider / DragonForce) halts online orders for 46 days",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-05-21",
      "title": "M&S estimates about £300M cost; disruption to last into July",
      "body": null,
      "sourceUrl": "https://www.reuters.com/business/media-telecom/britains-ms-says-cyberattack-cost-400-million-2025-05-21/",
      "url": "https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025"
    },
    {
      "incident": "marks-and-spencer-ransomware-scattered-spider-april-2025",
      "incidentTitle": "Marks & Spencer ransomware (Scattered Spider / DragonForce) halts online orders for 46 days",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-04-29",
      "title": "Attack linked to Scattered Spider and DragonForce ransomware on ESXi",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/marks-and-spencer-breach-linked-to-scattered-spider-ransomware-attack/",
      "url": "https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025"
    },
    {
      "incident": "marks-and-spencer-ransomware-scattered-spider-april-2025",
      "incidentTitle": "Marks & Spencer ransomware (Scattered Spider / DragonForce) halts online orders for 46 days",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-04-25",
      "title": "M&S pauses online orders after a cyber incident",
      "body": null,
      "sourceUrl": "https://www.reuters.com/business/retail-consumer/britains-ms-pauses-some-online-orders-after-cyber-incident-2025-04-25/",
      "url": "https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025"
    }
  ]
}