M&S Chairman Identifies DragonForce as Perpetrator of Major Ransomware Attack

Attribution of Cyberattack

• 🎯 Marks & Spencer (M&S) believes the ransomware operation behind its April cyberattack was conducted by a group named ‘DragonForce’.
• 🗣️ M&S Chairman Archie Norman informed UK lawmakers that loosely aligned parties collaborated on the cyberattack.
• 🌍 Norman stated that DragonForce is a ransomware operation believed to be based in Asia.

Impact and Aftermath of the Attack

• 🚫 The attack forced M&S to suspend online shopping for nearly seven weeks, halting online clothing orders and taking other systems offline.
• 📉 This disruption led to reduced food availability, increased waste, and higher logistics costs.
• 💰 M&S estimated the attack would cost approximately $49 million in lost operating profit.
• ⏳ While online clothing orders resumed on June 10th, click and collect services have yet to be fully restored.

Previous Attributions

• 📰 Media reports had previously attributed the attack to a hacking collective known as ‘Scattered Spider,’ which deploys ransomware from DragonForce.