https://pwn.watch/t/marks-and-spencer Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Tue, 10 Jun 2025 00:00:00 GMT https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025 https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025 Tue, 10 Jun 2025 00:00:00 GMT critical <p>Scattered Spider got in through social engineering of a third-party IT provider and encrypted M&amp;S's VMware ESXi hosts with DragonForce ransomware over Easter 2025. Contactless payments, Click &amp; Collect and online ordering broke; online orders were paused from April 25 to June 10. M&amp;S put the hit at about £300M of operating profit.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> no-fix-needed</p> <p><strong>Latest updates:</strong></p><ul><li>2025-06-10: Online clothing orders resume after 46 days (<a href="https://www.reuters.com/business/retail-consumer/uks-ms-resumes-online-orders-following-cyber-incident-2025-06-10/">source</a>)</li><li>2025-05-21: M&amp;S estimates about £300M cost; disruption to last into July (<a href="https://www.reuters.com/business/media-telecom/britains-ms-says-cyberattack-cost-400-million-2025-05-21/">source</a>)</li><li>2025-04-29: Attack linked to Scattered Spider and DragonForce ransomware on ESXi (<a href="https://www.bleepingcomputer.com/news/security/marks-and-spencer-breach-linked-to-scattered-spider-ransomware-attack/">source</a>)</li></ul>