Over Easter 2025 chaos broke out at Marks & Spencer: card payments stopped working, Click & Collect went down, and from April 25th online shopping was gone entirely. For 46 days one of the UKs biggest retailers could not take a single internet order, and the final damage came to roughly 300 million pounds in lost operating profit. The attackers were not a state-sponsored hacking unit but a group of young people between 17 and 20 years old.
The phone call
The attack on M&S did not start with an exploit and not with a zero-day vulnerability, but with a phone call. Sometime in February 2025 someone called the IT help desk, which is operated by Tata Consultancy Services (TCS), and pretended to be an M&S employee. The caller was convincing enough to get a password reset for an existing account, and with that the group Scattered Spider had a foot in the door.
M&S Chairman Archie Norman later publicly confirmed the attack vector: social engineering via the service desk, without any technical breakthrough in the traditional sense, just a telephone and a convincing story.
What happened next however shows that the attackers certainly knew what they were doing on the technical side.
From one password to the entire network
With the reset credentials the attackers were able to log into Active Directory and steal the NTDS.dit file, which contains all password hashes for every domain user. Anyone who has this file can crack the hashes offline (which takes minutes for weak passwords) and then has clear text passwords for potentially hundreds or thousands of accounts.
That is the point where a single compromised account becomes a full network takeover; with enough cracked credentials you can move laterally through the entire network, access servers, escalate privileges and eventually control practically everything. The attackers did exactly that and ultimately deployed DragonForce ransomware on M&S’s VMware ESXi infastructure, encrypting all servers.
DragonForce is a ransomware as a service provider based in Asia, where affiliates (in this case Scattered Spider) carry out the attacks and keep 80 percent of the ransom, while DragonForce takes a 20 percent cut.
The aftermath
The impact was considerable: online orders were impossible for 46 days (from April 25 to June 10), store employees had to handle inventory management and temperature monitoring manually because the systems were unavailable, and the total damage amounted to an estimated 300 million pounds in lost operating profit.
Stolen data included names, addresses, email addresses, phone numbers, dates of birth and online order histories of customers. Credit card data and passwords were not taken according to M&S.
On July 10 2025 the UKs National Crime Agency arrested four people: a 20 year old woman from Staffordshire, two 19 year old men (one British, one Latvian) from London and the West Midlands, and a 17 year old British male. Whether M&S paid a ransom, the chairman refused to confirm or deny. The total damage of the “combined cyber event” (M&S, Co-op and Harrods were all attacked by the same group in the same timeframe) is estimated at 270 to 440 million pounds.
Attack path and controls
What makes this case particularly instructive is that every single step in the attack could have been prevented by an established security control, not through exotic or expensive technology but through measures that should be part of the standard repertoire of every IT security department.
Step 1: Social engineering at the help desk
The attacker calls and pretends to be an employee. Strict identity verification (e.g callback to the registered number, personal security questions, or confirmation by the supervisor) would have stopped the attack right here. Many companies have such processes on paper, but in practice the help desk does not consistently enforce them because the pressure to close tickets quickly is high.
Step 2: Password reset
For privileged accounts (or really for all accounts) a password reset should require additional authentication: MFA confirmation, manager approval, or a separate verification channel. If a single help desk employee can reset a password without any cross-checking, that constitutes a systemic problem that needs to be addressed independently of the individual employees competence.
Step 3: Active Directory access
Privileged Access Management (PAM) systems restrict who can access the AD and from which devices. Network segmentation ensures that not every account can reach the domain controllers. Both would have made access to the NTDS.dit file more difficult or prevented it entirely.
Step 4: NTDS.dit stolen
Monitoring for unusual access to the NTDS.dit file (e.g via Volume Shadow Copy or ntdsutil) is a well known detection use case. A tiered admin model where Tier 0 accounts (domain admins) are only used on Tier 0 systems would have limited the blast radius.
Step 5: Hash cracking
Complex password policies and regular rotation make offline cracking harder (but not impossible). Managed Service Accounts and Group Managed Service Accounts eliminate the risk for service accounts completely.
Step 6: Lateral movement
Zero Trust architectures and microsegmentation limit the ability to move freely through the network with stolen credentials. If every access has to be re-authorized, cracked passwords alone are not enough.
Step 7: Ransomware deployment
Endpoint Detection and Response (EDR) on the ESXi hosts, isolated backups that do not depend on the same AD, and application whitelisting would have either detected the ransomware or reduced its impact to a minimum.
Step 8: Data exfiltration
Data Loss Prevention (DLP) and monitoring of outgoing network traffic (egress filtering) detect when large amounts of data leave the network. Combined with SIEM rules that alert on unusual data transfers, the exfiltration would have been noticed before it was completed.
Conclusion
What stands out about this case is not the technical sophistication of the attackers, which was not particularly high, but the simplicity of the attack vector: one phone call, one password reset, and 46 days later there is a 300 million pound damage bill. Scattered Spider has shown that you do not need to be a state-funded APT actor to bring a publicly listed corporation to its knees, and that the biggest vulnerability remains the human element, or more precisely: the processes that do not give people clear guardrails.
The four people arrested were between 17 and 20 years old…
Want to know whether your help desk processes would withstand a social engineering attack? Get in touch for a social engineering assessment.