UK authorities arrest four in major retail cyber attack probe

The National Crime Agency said four people have been arrested in the UK for their suspected participation in the cyber attacks that affected M&S, Co-op and Harrods.

 

Earlier this year, major UK retailers like Marks & Spencer, Co-op, and Harrods suffered significant cyber attacks that affected the retailers’ daily operations. Co-op reported that its systems were offline for two weeks affecting payments, restocking & funerary services, leading to empty shelves.

 

M&S, however, had to pause online clothing and home orders for nearly seven weeks, causing an estimated operating profit loss of up to £300 million for the 2025-2026 financial year.

 

Harrods also confirmed a cyber security breach in early May 2025. The attack targeted its internal systems, prompting the company to take precautionary measures such as restricting internet access at its retail locations to protect its infrastructure.

 

All of the data security incidents were linked to the hacker group “Scattered Spider”. The attackers stole critical authentication data (NTDS.dit file) and later deployed ransomware using the DragonForce encryptor, encrypting virtual servers and disrupting operations.

 

In a press release published on July 10, the National Crime Agency (NCA) said that UK police arrested four individuals, aged between 17 and 20, for their alleged involvement in cyber attacks targeting major retailers.

 

“Two males aged 19, another aged 17, and a 20-year-old female were apprehended in the West Midlands and London this morning (10 July) on suspicion of Computer Misuse Act offences, blackmail, money laundering and participating in the activities of an organised crime group.

 

“All four were arrested at their home addresses and had their electronic devices seized for digital forensic analysis,” the NCA said in its press release.

 

In a statement shared with the media, Deputy Director Paul Foster, head of the NCA’s National Cyber Crime Unit, said, “Since these attacks took place, specialist NCA cybercrime investigators have been working at pace and the investigation remains one of the Agency’s highest priorities.

 

“Today’s arrests are a significant step in that investigation but our work continues, alongside partners in the UK and overseas, to ensure those responsible are identified and brought to justice,” Deputy Director Foster added.