UK Retailers Face Rising Cybersecurity Threats

Problems at M&S began during the Easter weekend, when customers reported issues with contactless payments and the click-and-collect service. CEO Stuart Machin admitted that the company was dealing with a serious cyber incident that required operational changes to protect both customers and the company itself. The attack caused significant complications, including stock shortages and the inability of remote employees to access internal systems. On May 13, M&S confirmed that attackers gained access to customers’ personal data; however, payment card details and passwords were not compromised, and it’s not known whether this data has been published.

Similarly, Co-op faced a cyberattack on April 30 that affected their back-office systems and call centres. Remote workers were asked to keep cameras on during online meetings and avoid recording or sharing sensitive information. A few days later, it was discovered that hackers had gained access to an extensive customer database.

Harrods experienced an attempted cyberinfiltration on May 2. The luxury store promptly responded by restricting internet access at all its branches and engaged specialists to investigate and eliminate threats. Despite this, all stores and online services remained fully functional.

These attacks are not isolated incidents. Recently, British retail has faced increasingly frequent and sophisticated cyber threats, with JD Sports, Boots, and WHSmith among those affected. The National Cyber Security Centre (NCSC) is working with affected companies to strengthen their defenses, and the Committee for Trade and Business Affairs is demanding evidence from M&S and Co-op management on effective incident management.



According to experts, these attacks are a warning that retail must adopt security measures at the level of government agencies or financial institutions. With the increasing shift of sales to the online environment and the declining use of cash, system vulnerability is growing, requiring stricter security standards.

Attackers used social engineering, posing as employees and fraudulently obtaining password resets through the IT helpdesk. Groups DragonForce and Scattered Spider, known for their ransomware campaigns, are considered the main suspects.

The financial damage is significant – Deutsche Bank estimates that M&S suffered losses of approximately £30 million, with further weekly losses expected until the situation is resolved. Beyond financial impacts, the theft of data also threatens customer trust, which could lead to their defection to competitors.

As a result of these events, retailers’ interest in cyber insurance is growing, with insurers adjusting their terms according to current threat developments.

These events clearly show that even the largest British brands are not immune to cyberattacks. Strengthening cybersecurity and protecting customer data are becoming essential for maintaining operational stability and trust in the digital age.