Scattered Spider’s Cyberattack Unraveled: Inside the Marks & Spencer Breach

Scattered Spider’s Cyberattack Unraveled: Inside the Marks & Spencer Breach

• The attack: Ongoing outages at British retailer Marks & Spencer (M&S) are caused by a ransomware attack, BleepingComputer reported on April 28, 2025.
• The suspects: Sources linked the attack to threat actors known as Scattered Spider, also tracked by Microsoft as Octo Tempest.
• How it unfolded: The attackers reportedly stole M&S’s Active Directory password database as early as February.
• The damage: The DragonForce encryptor was reportedly deployed on VMware ESXi hosts on April 24, disrupting contactless payments and online orders.
• The response: M&S brought in CrowdStrike, Microsoft and Fenix24 to investigate, according to BleepingComputer.

Who Is Behind the Attack

Marks & Spencer, which has 64,000 employees and more than 1,400 stores worldwide, confirmed a cyberattack in late April 2025 that disrupted contactless payments and online ordering. Sky News reported that around 200 warehouse workers were told to stay home. BleepingComputer, citing multiple sources, linked the attack to threat actors who use tactics known as Scattered Spider. M&S said it could not go into details.

How the Breach Reportedly Unfolded

According to BleepingComputer’s sources, the attackers first got into M&S as early as February and stole the NTDS.dit file from a Windows domain controller. That file is the main Active Directory database and holds password hashes for Windows accounts. Cracked offline, those hashes become passwords. On April 24, they reportedly deployed the DragonForce encryptor to VMware ESXi hosts, encrypting virtual machines.

Social Engineering at the Core

The group’s specialty is people. Its tactics include phishing, MFA bombing (flooding a target with login prompts until they approve one), SIM swapping and calls to IT help desks while posing as employees. That is how the 2023 MGM Resorts attack began, when attackers impersonated an employee on a call to the help desk. M&S had not said how the attackers got in at the time this was reported.

Understanding the Players Involved

It isn’t one gang. The name describes a loose network of mostly young, English-speaking threat actors, some as young as 16, who share tactics on hacker forums, Telegram and Discord. Their English fluency makes their phone calls and messages more convincing. They have worked as affiliates for Russian-speaking ransomware operations, including BlackCat, RansomHub, Qilin and now DragonForce.

What Retailers Can Learn

The M&S attack shows how one stolen credential database can turn into a company-wide outage. Help desks are a soft spot. Identity checks for password and MFA resets need to be strict, because a single convincing phone call can hand an attacker the keys to the whole company.

Defenses That Target These Tactics

There are fixes. They can require phishing-resistant MFA, verify callers before resetting credentials and watch for theft of the NTDS.dit file. Regular drills that simulate help desk impersonation also help staff recognize the pattern.

The Bigger Picture

Law enforcement in the US, the UK and Spain has arrested people linked to Scattered Spider over the past two years, but the attacks continue. For large retailers, the lesson from M&S is that attackers are as likely to phone the help desk as to exploit a server.

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.