The financial impact of the recent cyber incident on Marks & Spencer (M&S) and the Co-op could be as much as £440m, according to estimates by the Cyber Monitoring Centre (CMC).
In April 2025 UK retailers M&S and the Co-op both suffered a major breach. The cyber attacks not only significantly disrupted online and in-store services at both companies, but also resulted in personal customer data being stolen.
The attacks were publicly claimed by representatives of the DragonForce ransomware-as-a-service operation.
Scattered Spider, an affiliate collective, carried out the attacks using DragonForce’s tools.
CMC – an independent, non-profit body categorising major cyber events – has performed an assessment of the financial impact of the attacks.
It says it is treating the attacks as “single combined cyber event” because one threat actor claimed responsibility for both; the two events happened close together; and similar tactics, techniques and procedures were used.
Classified as a...