Cyber Siege Alert: Google Warns US Retailers of Looming Threat

Google Warns US Retailers After UK Retail Attacks

• Targeted Attacks: Hackers behind the UK retail attacks are now targeting US retailers, Google says.
• Google’s Warning: Google analyst John Hultquist called the group aggressive and creative.
• Suspected Group: The activity is linked to Scattered Spider, known for help desk social engineering.
• Defenses: Retailers should harden help desk identity checks and account recovery.

Hackers Who Hit UK Retail Turn to the US

US retailers went on alert in May 2025 after Google warned that the hackers behind recent UK retail attacks had started targeting American stores. The UK wave hit big names including Marks & Spencer and Co-op.

What Google Said

John Hultquist, chief analyst at Google Threat Intelligence Group, told reporters that the US should take note. “These actors are aggressive, creative, and particularly adept at circumventing mature security programs,” he said, adding that he expected retail to stay a focus. (A quote attributed to an unnamed Google spokesperson in an earlier version has been removed because we could not confirm it.)

How the Group Gets In

The group linked to the attacks, often tracked as Scattered Spider, leans on social engineering. Members call IT help desks pretending to be employees, then talk staff into resetting passwords or multi-factor settings. Ransomware can follow once they are inside. Retailers should tighten how the help desk verifies callers, and protect customer data with layered controls.

What’s at Stake for US Retailers

The UK attacks showed how costly this gets. Beyond direct financial losses, retailers face lost customer trust. Damage to their reputation and possible regulatory penalties add pressure to review security now. (A quote attributed to a named cybersecurity expert has been removed because we could not confirm it.)

Defenses and Industry Response

Security teams recommend strong identity checks at the help desk, encryption of sensitive data, staff training and current threat intelligence. Sharing data between companies helps too. The Retail & Hospitality ISAC (RH-ISAC), formerly the Retail Cyber Intelligence Sharing Center (R-CISC), lets members swap threat data and insights.

The Takeaway for Retailers

US retailers now face a tested playbook that worked against UK chains. Google’s alert gives them a head start. Teams that lock down help desk resets this month will be far harder to hit than those that wait.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.