Marks & Spencer Breach Exposes Customer Data Due to Third Party, DragonForce Claims Attack

• M&S revealed that a third-party breach is believed to be at the root of the recent cyberattack that halted operations.
• DragonForce claimed the ransomware attack, gaining access via a third party who had access to company systems.
• The stolen data could include names, dates of birth, contact details, household information, and order histories.

Marks and Spencer (M&S), a prominent British retailer, has confirmed that personal customer information was compromised following a sophisticated ransomware attack that began in April and exploited vulnerabilities through a third-party supplier with access to M&S systems.

The company acknowledged that limited customer details were extracted, but payment details or account passwords were not exposed. M&S stated there is currently no evidence indicating that the stolen data has been shared.

The breach was attributed to a group identifying as DragonForce and is believed to be stemming from a third-party provider with privileged access to the company’s systems.

M&S confirmed that stolen data could include names, dates of birth, contact details, household information, and order histories. Importantly, the company asserts that payment card details and passwords were not compromised due to robust data segmentation practices.

This security incident forced the company to halt online orders for over three weeks and caused widespread operational disruption, including significant inventory shortages in stores after key food-related systems were taken offline.

The attack has caused significant operational and financial disruptions, leading to a notable 15% drop in the company's share price since the Easter weekend. 

Analysts estimate a profit hit of at least £30 million (approximately $39.5 million), with a run rate at approximately £15 million (about $20 million) weekly, though much of this could be covered by cyber insurance to a limited extent.

M&S has implemented enhanced security measures to prevent further vulnerabilities and reassured customers that no immediate action is required on their part. Meanwhile, the retailer’s 1,000 stores remain open.

In April, DragonForce announced the takeover of the infamous RansomHub ransomware, which is to be incorporated into its infrastructure.