Four people total were arrested in connection with an April cyberattack that disrupted operations at Marks & Spencer, Harrods and Co-op.
The British police arrested four people, including three teenagers, on Thursday in connection with an April cyberattack that cost the retail giant Marks & Spencer millions of pounds and disrupted operations at Harrods and Co-op.
Three males, two aged 19 and another aged 17, and one female, 20, were apprehended at their homes in the West Midlands and in London on Thursday morning, the authorities said. All four people remain in custody, arrested on suspicion of Computer Misuse Act offenses, blackmail, money laundering and participating in an organized crime group, according to a statement by Britain’s National Crime Agency. Electronic devices were seized as part of the investigation.
“Today’s arrests are a significant step in that investigation but our work continues, alongside partners in the U.K. and overseas, to ensure those responsible are identified and brought to justice,” said Paul Foster, the head of the national cybercrime unit, in a statement.
Among the three retailers, Marks & Spencer, one of Britain’s largest, was hit hardest. The attack caused months of damage. The company said in May that the “highly sophisticated” attack cost it about 300 million pounds ($407 million) in lost profits this year. The attack also forced staff to use manual processes and caused food waste to pile up. Some customer data was also stolen in the attack.
Marks & Spencer said that the breach was the result of human error. The hackers had gained access to the company’s systems through social engineering tricks via a third-party supplier, the company said. On Thursday, Marks & Spencer said in a statement it welcomed the development in the National Crime Agency’s investigation.
Archie Norman, the chairman of Marks & Spencer, this month called for the mandatory reporting of cyber incidents. “It’s apparent to us that quite a large number of serious cyberattacks never get reported,” he said, adding that there had been two major attacks of large British companies in recent months that had gone unreported.
Harrods also experienced disruptions, with internet access briefly restricted at its sites as a security measure, and Co-op reported that the cyberattack disrupted some back office and call center services.
The National Crime Agency did not respond to questions about whether the four individuals were linked to Scattered Spider, a hacker group that was being investigated in connection with the Marks & Spencer attack. The group is known for social engineering campaigns in which it tricks people into providing passwords or other credentials to break into a company’s computer network.
