INCIDENT REPORT · CP-2025-004

Marks & Spencer ransomware attack

L3 · ELEVATEDCONFIRMED

UK retailer Marks & Spencer disclosed a cyber incident over the Easter 2025 period that led it to suspend online ordering; reporting linked the intrusion to DragonForce ransomware.

Incident ID: CP-2025-004
Disclosure date: 22 APR 2025
Detection date: Not publicly documented
Affected countries: United Kingdom
Plotted location: London, United Kingdom (Affected organization headquarters)
Threat classification: Level 3 — ELEVATED
Classification rationale: Major national retailer suffered weeks of disruption and a nine-figure profit hit.
Attack type: Ransomware
Nature: Malicious activity
Attack vector: Not publicly documented
Sectors: Retail
Critical infrastructure: No
Organizations affected: Marks & Spencer
Operational consequences: Online sales were halted for around six weeks and store operations disrupted; M&S estimated the attack would reduce 2025/26 operating profit by around GBP 300 million before mitigation. UK police arrested four people in July 2025 in connection with the M&S, Co-op and Harrods attacks.
Estimated financial impact: M&S estimated an approximately GBP 300 million hit to 2025/26 operating profit before mitigation (full-year results, 21 May 2025). No USD figure stated by the company.
Attribution (as stated): Claimed by / reported as linked to Scattered Spider-associated actors using DragonForce ransomware; NCA arrested four suspects (aged 17-20) in July 2025

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

Marks & Spencer ransomware attack

L3 · ELEVATEDCONFIRMED

UK retailer Marks & Spencer disclosed a cyber incident over the Easter 2025 period that led it to suspend online ordering; reporting linked the intrusion to DragonForce ransomware.

Incident ID

CP-2025-004

Disclosure date

22 APR 2025

Detection date

Not publicly documented

Affected countries

United Kingdom

Plotted location

London, United Kingdom (Affected organization headquarters)

Threat classification

Level 3 — ELEVATED

Classification rationale

Major national retailer suffered weeks of disruption and a nine-figure profit hit.

Attack type

Ransomware

Nature

Malicious activity

Attack vector

Not publicly documented

Sectors

Retail

Critical infrastructure

Organizations affected

Marks & Spencer

Operational consequences

Online sales were halted for around six weeks and store operations disrupted; M&S estimated the attack would reduce 2025/26 operating profit by around GBP 300 million before mitigation. UK police arrested four people in July 2025 in connection with the M&S, Co-op and Harrods attacks.

Estimated financial impact

M&S estimated an approximately GBP 300 million hit to 2025/26 operating profit before mitigation (full-year results, 21 May 2025). No USD figure stated by the company.

Attribution (as stated)

Claimed by / reported as linked to Scattered Spider-associated actors using DragonForce ransomware; NCA arrested four suspects (aged 17-20) in July 2025