Major Uk retailers Cyberattack

[Alvin63]

Just had this email today. How can a company this big not have better protection?!! Last time I had an email like this from another company they at least gave you a year's free Experian membership!


I am sure that you will have seen in the news that we have been dealing with a cyber incident and I wanted to write to you about what this means for you.

What has happened?
To proactively manage the incident, we immediately took steps to protect our systems and engaged leading cyber security experts. We also reported the incident to relevant government authorities and law enforcement, who we continue to work closely with.

Unfortunately, the nature of the incident means that some personal customer data has been taken, but there is no evidence that it has been shared. The personal data could include contact details, date of birth and online order history. However, importantly, the data does not include useable card or payment details, and it also does not include any account passwords. For more detail, see our FAQs.


How does this affect me and what should I do?
You do not need to take any action, but you might receive emails, calls or texts claiming to be from M&S when they are not, so do be cautious. Remember that we will never contact you and ask you to provide us with personal account information, like usernames, and we will never ask you to give us your password.


For more information, FAQs and hints and tips on how to stay safe online visit corporate.marksandspencer.com/cyber-update


To give you extra peace of mind, next time you visit or login to your M&S.com account on our website or app, you will also be prompted to reset your password.


We sincerely apologise for any inconvenience caused to you and all of our customers.

 

[philmckrackon]

Blanket protection email.

 

[zappaDPJ]

The personal data could include contact details, date of birth and online order history. However, importantly, the data does not include useable card or payment details, and it also does not include any account passwords. For more detail, see our FAQs.

I'd argue that the harvested personal data is potentially a lot more damaging to the customer than stolen payment details. Assuming you used a credit card you are protected against theft but even the brightest of people can fall foul of phishing attempts for which there is little or no protection.

Hopefully the ICO will levy an eye watering fine, M&S will learn an important lesson and tighten their security.

 

[Alvin63]

That last line is ridiculous "We sincerely apologise for any inconvenience caused ........." It's much more than inconvenience! I've emailed them back and asked for a free year's Experian subscription (identity fraud protection - it notifies you if anything new is taken out in your name or address and checks if it was you).

Also the Co-op has had the same cyberattack and Harrods as well (news says a number of retail companies).

So presumably passwords and bank details are encrypted? Why isn't everything encrypted?!

And this is why I rarely use my real date of birth when signing up for anything! (Some places you have no option but to use real dob but those are usually very secure sites).

 

[Alvin63]

M&S ask you to reset your pw at login - but then the reset email doesn't arrive They are clearly swamped with this.

 

[Alvin63]

Three major retailers — Marks & Spencer (M&S), Co-op and Harrods — were subjected to major cyber-attacks in the past week as part of apparent blackmail schemes, with the hackers themselves warning that further attacks to UK retailers are in the works.
The attack on M&S is believed to be the work of ransomware group DragonForce, a cybercriminal syndicate that operates ransomware which is then used to carry out attacks and extortions.

DragonForce may be linked to the infamous hacking group Scattered Spider, which is said to be behind over 100 targeted attacks since 2022 including on casino operator Caesars Entertainment, which paid a £11.2m ransom to restore its network.

M&S, Co-op & Harrods Cyber-attacks — Cyber Security Tips for Retailers

Three major retailers were subjected to cyber-attacks in the past week. Here's five key steps to take in any cyber-attack preparedness and response plan.

www.brabners.com

 

[Alvin63]

From that first BBC link above

"The hackers, who were fluent English speakers, revealed to the BBC they had compromised Co-op and stolen a large amount of customer and employee data.

They would not discuss the M&S hacks. But it is thought DragonForce ransomware was used to scrambled the firm's IT servers."

So they've actually been chatting to the BBC!

 

[zappaDPJ]

Something that made me chuckle which has now been removed from that BBC article (can't imagine why) is M&S sent out an email warning people to beware of any emails coming from them

 

[Alvin63]

How do you know it was in there and removed? Had you seen it before?

 

[zappaDPJ]

How do you know it was in there and removed? Had you seen it before?

It was there when the article was first published but I imagine someone pointed out the absurdity and removed it.

 

[Suzanne O]

@Alvin63

Check this site to see if you're email's been affected https://www.haveyoubeenpwned.com

 

[Alvin63]

Thanks done that before and it has been in the past already I've just set up an experian identity plus account which notifies you if any details are used. And asked M&S to refund me the monthly cost Apparently some people are thinking of lawsuits for compensation on various grounds but that sounds like hassle. I'll just protect my ID.

 

[Alvin63]

Just had a whole bunch of emails from M&S saying your payment card details have been changed. Which I didn't do - so am treating those as phishing. Except they were actually from M&S and said phone us if you didn't change this yourself. So phoned them and they just say - we're having an incident you can ignore the emails. I said - but the emails said to phone you if I didn't change the payment details yourself, which I didn't.

Big mess! If I haven't changed the payment details and M&S hasn't changed them, then either someone else has changed them or the hackers are sending out fake emails from M&S genuine email address.

 

[zappaDPJ]

Big mess!

It is and you are right to treat any unsolicited email, text, phone call or letter as an attempt to rob you even if it isn't.

It's likely that the data compromised within M&S contained the last four digits of people's card details. It also seems likely that M&S refused to pay the ransom so the hackers are almost certainly going to sell the data on.

The next time your bank rings you regarding suspicious activity on your account and reads off the last four numbers on your payment card... assume it's a scam because it probably is.

 

[Alvin63]

I also guessed that. That M&S will refuse to pay the ransom so the hackers are going to do more stuff in the meantime.

Edit the emails probably were phishing emails. I noticed the phone number in the letter was a clickable link. I had just googled the phone number first to check it was genuine. We also have an account with the Co-op so double trouble!