Four Arrested Over M&S, Co-op, Harrods Cyber Attacks

Four individuals—a 20-year-old woman, two 19-year-old men, and a 17-year-old male—were arrested in London, the West Midlands, and Staffordshire for alleged involvement in cyber-attacks on Marks & Spencer (M&S), the Co-op, and Harrods that began in April 2024. The UK National Crime Agency (NCA) detained the suspects on suspicion of blackmail, money laundering, Computer Misuse Act offences, and organized crime, seizing electronic devices for forensic analysis. The attacks, linked to the Scattered Spider group—comprised largely of British and American youths—caused major disruptions, with M&S halting online orders, suffering empty shelves, and losing an estimated £300 million. Ransomware was used in the M&S attack, resulting in demands for payment and theft of large quantities of customer and staff data. The Co-op and Harrods also experienced significant data breaches and operational impacts. The NCA called the arrests a significant step, but the investigation continues with international cooperation.