# Understanding and Mitigating Scattered Spider Attacks on Retail Giants *Category: Threat Intelligence · Author: Cyber Data Services Team · Published: 2025-01-19 · https://cyberdataservices.uk/blogs/scattered-spider-retail-attacks-2025* > In 2025 the UK retail sector was hit by a wave of attacks on Marks & Spencer, the Co-op, and Harrods, all attributed to Scattered Spider. Here's who they are, what they did, and the hardening steps every business should take now. In 2025, the UK retail sector suffered a series of cyber attacks targeting Marks & Spencer, the Co-op, and Harrods. These attacks, attributed to the hacking group known as Scattered Spider, caused significant disruptions and financial losses. We aim to provide a comprehensive understanding of these incidents and offer proactive hardening recommendations to help safeguard against similar threats. ## Who or What Is Scattered Spider? Scattered Spider is a loosely affiliated hacking group composed of English-speaking teenagers and young adults from the UK and US, operating like an organised criminal network. The group has been linked to over 100 cyber-attacks since 2022, targeting sectors including telecoms, finance, retail, and gaming. Their method typically involves using social engineering to gain an initial foothold, then exploiting internal vulnerabilities to cause maximum damage. The 2025 attacks on UK retail giants demonstrated their capability: - **Marks & Spencer:** Online order suspension and store shortages, resulting in significant market value loss - **Harrods:** Customer data security challenges and operational disruptions - **Co-op:** Stock level disruptions affecting inventory management and customer service ## Proactive Hardening Recommendations Based on guidance from Google's security teams, organisations should implement the following hardening measures: ### Identity Management - Implement phishing-resistant authentication methods such as hardware security keys and software passkeys - Transition to passwordless authentication where possible - Apply the principle of minimum access to all user accounts and roles - Remove SMS, phone calls, and email as primary authentication factors - Require positive identity verification for all help desk requests - Restrict MFA registration to trusted locations only - Monitor and log all MFA registration events for suspicious activity - Enforce multi-context criteria for sensitive operations ### Endpoint Security - Deploy Endpoint Detection and Response (EDR) solutions across all endpoints - Maintain up-to-date software and systems with regular patching and updates ### Application and Resource Protection - Implement secure configurations for all applications and resources - Deploy application whitelisting to prevent unauthorised software execution ### Network Infrastructure - Implement network segmentation to isolate critical systems - Adopt a Zero Trust security model for all network access ### Monitoring and Detection - Deploy advanced threat detection and response capabilities - Implement behavioural analytics to identify anomalous user activity ## Conclusion The threat landscape continues to evolve, with groups like Scattered Spider demonstrating sophisticated attack capabilities. By implementing these proactive hardening recommendations, organisations can significantly reduce their risk exposure and improve their security posture. Cyber Data Services offers comprehensive solutions to help protect your organisation: - Phishing-resistant login implementations - EDR solutions and endpoint protection - Zero Trust architecture design and deployment Reach out to us today to discuss how we can help secure your organisation against these emerging threats. --- Source: https://cyberdataservices.uk · Cyber Data Services (trading name of Tom Sykes Ltd, company no. 06947397), part of the Stiperstone Group. General information only, not specific security or legal advice. For guidance on your own systems, contact info@cyberdata.services or 01952 972 404.