{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T21:47:37.879Z",
  "tag": {
    "id": "scattered-spider",
    "label": "Scattered Spider",
    "isStack": false,
    "url": "https://pwn.watch/t/scattered-spider",
    "feed": "https://pwn.watch/t/scattered-spider/feed.xml"
  },
  "counts": {
    "incidents": 3,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 3
  },
  "incidents": [
    {
      "slug": "qantas-contact-centre-breach-july-2025",
      "title": "Qantas: 5.7M customers' data stolen from a contact-centre platform",
      "url": "https://pwn.watch/i/qantas-contact-centre-breach-july-2025",
      "json": "https://pwn.watch/i/qantas-contact-centre-breach-july-2025.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "Qantas contact-centre (third-party platform)",
      "tags": [
        "qantas",
        "aviation",
        "scattered-spider",
        "data-breach"
      ],
      "cveIds": [],
      "affectedVersions": [
        "n/a"
      ],
      "fixedVersions": [],
      "startedAt": "2025-06-30",
      "closedAt": "2025-07-09",
      "updatedAt": "2025-07-09",
      "summary": "A cyber criminal accessed a third-party customer-service platform used by a Qantas contact centre. After deduplication, 5.7M unique customers were affected: names, emails, frequent-flyer details, and for some phone numbers, birth dates, addresses, gender and meal preferences. No passwords, PINs, card or passport data were taken.",
      "xPost": null
    },
    {
      "slug": "marks-and-spencer-ransomware-scattered-spider-april-2025",
      "title": "Marks & Spencer ransomware (Scattered Spider / DragonForce) halts online orders for 46 days",
      "url": "https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025",
      "json": "https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "no-fix-needed",
      "product": "Marks & Spencer (retail IT, VMware ESXi)",
      "tags": [
        "marks-and-spencer",
        "scattered-spider",
        "dragonforce",
        "vmware",
        "ransomware"
      ],
      "cveIds": [],
      "affectedVersions": [
        "n/a"
      ],
      "fixedVersions": [],
      "startedAt": "2025-04-22",
      "closedAt": "2025-06-10",
      "updatedAt": "2025-06-10",
      "summary": "Scattered Spider got in through social engineering of a third-party IT provider and encrypted M&S's VMware ESXi hosts with DragonForce ransomware over Easter 2025. Contactless payments, Click & Collect and online ordering broke; online orders were paused from April 25 to June 10. M&S put the hit at about £300M of operating profit.",
      "xPost": null
    },
    {
      "slug": "mgm-resorts-caesars-scattered-spider-2023",
      "title": "MGM Resorts and Caesars hit by Scattered Spider",
      "url": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023",
      "json": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "MGM Resorts International; Caesars Entertainment",
      "tags": [
        "mgm-resorts",
        "caesars",
        "scattered-spider",
        "alphv",
        "ransomware",
        "social-engineering",
        "data-breach"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2023-09-07",
      "closedAt": "2023-10-05",
      "updatedAt": "2023-10-05",
      "summary": "Scattered Spider, an ALPHV/BlackCat affiliate, used social engineering to breach two Las Vegas casino giants. Caesars lost its loyalty program database and reportedly paid about $15M. MGM shut down systems for days and estimated a $100M hit, with pre-March-2019 customer data stolen.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "qantas-contact-centre-breach-july-2025",
      "incidentTitle": "Qantas: 5.7M customers' data stolen from a contact-centre platform",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-07-09",
      "title": "Qantas update: 5.7M unique customers affected",
      "body": null,
      "sourceUrl": "https://www.qantasnewsroom.com.au/media-releases/update-on-qantas-cyber-incident-wednesday-9-july-2025/",
      "url": "https://pwn.watch/i/qantas-contact-centre-breach-july-2025"
    },
    {
      "incident": "qantas-contact-centre-breach-july-2025",
      "incidentTitle": "Qantas: 5.7M customers' data stolen from a contact-centre platform",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-07-02",
      "title": "Qantas discloses the cyber incident (initially 6M records)",
      "body": null,
      "sourceUrl": "https://www.qantasnewsroom.com.au/media-releases/qantas-cyber-incident/",
      "url": "https://pwn.watch/i/qantas-contact-centre-breach-july-2025"
    },
    {
      "incident": "marks-and-spencer-ransomware-scattered-spider-april-2025",
      "incidentTitle": "Marks & Spencer ransomware (Scattered Spider / DragonForce) halts online orders for 46 days",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-06-10",
      "title": "Online clothing orders resume after 46 days",
      "body": null,
      "sourceUrl": "https://www.reuters.com/business/retail-consumer/uks-ms-resumes-online-orders-following-cyber-incident-2025-06-10/",
      "url": "https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025"
    },
    {
      "incident": "marks-and-spencer-ransomware-scattered-spider-april-2025",
      "incidentTitle": "Marks & Spencer ransomware (Scattered Spider / DragonForce) halts online orders for 46 days",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-05-21",
      "title": "M&S estimates about £300M cost; disruption to last into July",
      "body": null,
      "sourceUrl": "https://www.reuters.com/business/media-telecom/britains-ms-says-cyberattack-cost-400-million-2025-05-21/",
      "url": "https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025"
    },
    {
      "incident": "marks-and-spencer-ransomware-scattered-spider-april-2025",
      "incidentTitle": "Marks & Spencer ransomware (Scattered Spider / DragonForce) halts online orders for 46 days",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-04-29",
      "title": "Attack linked to Scattered Spider and DragonForce ransomware on ESXi",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/marks-and-spencer-breach-linked-to-scattered-spider-ransomware-attack/",
      "url": "https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025"
    },
    {
      "incident": "marks-and-spencer-ransomware-scattered-spider-april-2025",
      "incidentTitle": "Marks & Spencer ransomware (Scattered Spider / DragonForce) halts online orders for 46 days",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-04-25",
      "title": "M&S pauses online orders after a cyber incident",
      "body": null,
      "sourceUrl": "https://www.reuters.com/business/retail-consumer/britains-ms-pauses-some-online-orders-after-cyber-incident-2025-04-25/",
      "url": "https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025"
    },
    {
      "incident": "mgm-resorts-caesars-scattered-spider-2023",
      "incidentTitle": "MGM Resorts and Caesars hit by Scattered Spider",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-10-05",
      "title": "MGM 8-K: about $100M impact on Adjusted Property EBITDAR, data of customers from before March 2019 stolen",
      "body": null,
      "sourceUrl": "https://www.sec.gov/Archives/edgar/data/789570/000119312523251667/d461062d8k.htm",
      "url": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023"
    },
    {
      "incident": "mgm-resorts-caesars-scattered-spider-2023",
      "incidentTitle": "MGM Resorts and Caesars hit by Scattered Spider",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-09-14",
      "title": "Caesars 8-K filing; reports say it paid about half of a $30M demand",
      "body": null,
      "sourceUrl": "https://www.cnbc.com/2023/09/14/caesars-paid-millions-in-ransom-to-cybercrime-group-prior-to-mgm-hack.html",
      "url": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023"
    },
    {
      "incident": "mgm-resorts-caesars-scattered-spider-2023",
      "incidentTitle": "MGM Resorts and Caesars hit by Scattered Spider",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-09-12",
      "title": "MGM statement on the cybersecurity issue",
      "body": null,
      "sourceUrl": "https://investors.mgmresorts.com/2023-09-12-MGM-RESORTS-INTERNATIONAL-STATEMENT-ON-CYBERSECURITY-ISSUE",
      "url": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023"
    },
    {
      "incident": "mgm-resorts-caesars-scattered-spider-2023",
      "incidentTitle": "MGM Resorts and Caesars hit by Scattered Spider",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-09-11",
      "title": "MGM Resorts discloses a cybersecurity issue and shuts down systems; reservations, slot machines and ATMs are disrupted",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/mgm-resorts-ransomware-attack-led-to-100-million-loss-data-theft/",
      "url": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023"
    },
    {
      "incident": "mgm-resorts-caesars-scattered-spider-2023",
      "incidentTitle": "MGM Resorts and Caesars hit by Scattered Spider",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-09-07",
      "title": "Caesars determines the attacker copied its loyalty program database, including driver's license and/or SSNs for many members",
      "body": null,
      "sourceUrl": "https://www.sec.gov/Archives/edgar/data/1590895/000119312523235015/d537840d8k.htm",
      "url": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023"
    }
  ]
}