Marks & Spencer cyber attack sparks customer data security fears

The recent ransomware attack on British retailer Marks and Spencer exposed sensitive customer information, prompting concerns from cybersecurity professionals and the public about the potential impact and the necessary response. The incident, which saw data such as names, addresses, and contact details compromised but without financial information, has reinforced the importance of robust cybersecurity measures and comprehensive incident response plans.

Matt Hull, head of Threat Intelligence at cybersecurity consultancy NCC Group, characterised the breach as a cautionary tale for all organisations. "The data breach at M&S is a stark reminder that no organisation is completely immune from cyber threats, and that all forms of customer data require stringent protection," Hull commented. He emphasised that while preventing such incidents should be a top priority, every business must be prepared to react swiftly if a breach does occur.

"This incident serves as a call to action for companies to reassess their proactive cyber security strategies and incident response plans. Prevention is, of course, preferable, but should the worst happen, businesses need the ability to react quickly to contain the damage and minimise the impact on customers, no matter the type of data involved in a breach," Hull added.

Despite no financial data or passwords being compromised in the Marks and Spencer incident, Hull stressed that stolen information could enable threat actors to execute targeted social engineering or phishing attacks. "Threat actors could potentially use the stolen information to launch targeted social engineering attacks. Stay vigilant for phishing messages pretending to be from M&S or other companies you've dealt with. These attackers might use the leaked M&S information to craft very convincing scams," he warned, highlighting that data stolen in such breaches is often sold on the dark web, further increasing customers' exposure to risk.

Hull advised customers to remain cautious, particularly when interacting with emails or online messages. "If you're unsure about an email's authenticity, don't click any links. Instead, visit the company's website directly to verify any claims. This extra step can protect you from falling victim to phishing attacks," he counselled.

The attack on Marks and Spencer and a similar incident affecting the Co-op have drawn significant public attention. Professor Oli Buckley, Professor of Cyber Security at Loughborough University, offered insights into the wider impact such events have on organisations and the public psyche. "Nobody wants to think of Percy Pig or Colin the Caterpillar being embroiled in cybercrime," Buckley observed, referencing some of M&S's iconic products. "For several people, these attacks have really brought home that an incident can impact all of us; it's not just big tech giants or 'new' companies that are affected."

Buckley compared the aftermath of a cyber attack to dealing with a burst pipe, explaining that, while some might expect a swift resolution, the repercussions often unfold over time. "Marks & Spencer and the Co-op are facing that kind of incident, it's the equivalent of a burst pipe, but it isn't just one room that's flooded, instead we're seeing the floorboards starting to warp and the plaster get a bit soggy."

He also pointed out that large retailers like Marks and Spencer and the Co-op are "complex ecosystems," where a cyber incident can ripple through supply chains, delivery routes, and customer service teams. In the Co-op's case, for example, supply issues have seen some stores prioritised for essential goods, leaving shortages in others.

Regarding the disclosure of information, Buckley argued that managing such incidents requires careful, logical approaches rather than hasty conclusions. "The delayed release of information is not necessarily a negative thing, instead it points to things being handled cautiously and in a logical manner. Incident response is all about getting things right first and foremost and so jumping to conclusions to get the answer out there quickly would not be a good option."

The incidents at Marks and Spencer and the Co-op have underscored the pervasive risk posed by cyber criminals and the critical need for diligence from companies and customers in protecting personal data.