NCA Arrests Four Over £300M Cyberattacks on M&S, Co-op, Harrods

British authorities have arrested four individuals aged 17 to 20 in connection with a series of cyberattacks targeting major UK retailers Marks & Spencer, the Co-op, and Harrods in April 2025. The suspects, including a 20-year-old woman from Staffordshire, two 19-year-old males, and a 17-year-old male, face charges related to the Computer Misuse Act, blackmail, money laundering, and participation in an organised crime group. The attacks involved ransomware deployment that severely disrupted operations: M&S faced a six-week shutdown of online services with an estimated £300 million profit loss, the Co-op experienced payment system disruptions and data theft, and Harrods restricted internet access to prevent further damage. Investigators linked the breaches to the hacking group "Scattered Spider," which used social engineering tactics such as phishing and SIM swapping to gain access before deploying ransomware from the "DragonForce" operation. The National Crime Agency's National Cyber Crime Unit, supported by regional crime units, described the arrests as a significant step in a high-priority investigation, with work ongoing to bring all responsible parties to justice. Law enforcement emphasized the importance of businesses reporting cyber incidents promptly to aid investigations and mitigate disruption.