Advancing UK Aerospace, Defence, Security & Space Solutions Worldwide
  • Home
  • /
  • Security
  • /
  • NCA arrest four for cyber attacks on M&S, Co-op and Harrods

Security

NCA arrest four for cyber attacks on M&S, Co-op and Harrods

Four people have been arrested in the UK this morning as part of a National Crime Agency (NCA) investigation into cyber attacks targeting M&S, Co-op and Harrods.

Image courtesy NCA

Two males aged 19 another aged 17 and a 20-year-old female were apprehended in the West Midlands and London this morning on suspicion of Computer Misuse Act offences, blackmail, money laundering and participating in the activities of an organised crime group.

All four were arrested at their home addresses and had their electronic devices seized for digital forensic analysis.

Advertisement
ODU RT

They remain in custody for questioning by officers from the NCA's National Cyber Crime Unit in relation to the three attacks, which took place in April this year.

Deputy Director Paul Foster, head of the NCA's National Cyber Crime Unit, said: "Since these attacks took place, specialist NCA cybercrime investigators have been working at pace and the investigation remains one of the Agency's highest priorities.

"Today's arrests are a significant step in that investigation but our work continues, alongside partners in the UK and overseas, to ensure those responsible are identified and brought to justice.

"Cyber attacks can be hugely disruptive for businesses and I'd like to thank M&S, Co-op and Harrods for their support to our investigations. Hopefully this signals to future victims the importance of seeking support and engaging with law enforcement as part of the reporting process. The NCA and policing are here to help."

Today's operational activity was supported by officers from the West Midlands Regional Organised Crime Unit and the East Midlands Special Operations Unit.

Kevin Robertson, CTO of Acumen Cyber, said: “The dawn raids by the NCA, supported by the FBI, confirm that even highly distributed extortion crews such as Scattered Spider can be unmasked when their forensic breadcrumbs are stitched together.

Advertisement
DSEI 2025

The group is alleged to have breached M&S on 17th April and the Co-op two weeks later before detonating DragonForce ransomware, inflicting huge losses against retailers.

"However, the wider threat persists. Scattered Spider’s operators excel at impersonating staff, tricking IT help-desks into password resets, then bypassing MFA through SIM-swap and adversary-in-the-middle phishing before exfiltrating data or deploying ransomware. 

"Organisations should seize this opportunity to harden identity paths: roll out phishing-resistant MFA, require out-of-band verification for help-desk resets, monitor impossible-travel and token-reuse signals and segment critical systems from ad-hoc remote-management tools.

"These arrests are a strategic win for law enforcement but the operational battle against identity-centric ransomware crews is far from over.”

Victims of cybercrime should use the Government's Cyber Incident Signposting Site for direction on which agencies to report an incident to.

Advertisement
Amentum banner Amentum banner
GPS tags reduce reoffending

Security

GPS tags reduce reoffending

29 August 2025

Reoffending by burglars, robbers and thieves has been cut by 20% thanks to the tracking of their movements with tags, a new report published earlier this week has found.

Galvion hits 1.25m helmets milestone

Defence Security Events

Galvion hits 1.25m helmets milestone

28 August 2025

Galvion has reached a significant head system sales milestone with over 1.25 million helmets ordered by NATO and allied customers.

New SIA Chair to be appointed in 2026

Security

New SIA Chair to be appointed in 2026

27 August 2025

Heather Baily, the Chair of the Security Industry Authority (SIA) has today announced that she will be stepping down from the role on 28th February 2026.

PAL Aerospace to acquire Airtask Group

Aerospace Security

PAL Aerospace to acquire Airtask Group

26 August 2025

PAL Aerospace has completed its acquisition of Milton Keynes-headquartered Airtask Group, subject to certain regulatory matters.

Advertisement
Amentum rectangle
MoD Police receive two new intercept and escort boats

Defence Security

MoD Police receive two new intercept and escort boats

26 August 2025

Defence, Equipment & Support (DE&S) has delivered the first two of 24 new Intercept and Escort Craft to Ministry of Defence (MoD) Police under the fleet modernisation programme across three naval bases.

British Army EOD troop move into new base

Defence Security

British Army EOD troop move into new base

21 August 2025

A specialist British Army Explosive Ordnance Disposal (EOD) troop has moved into its new home at Gamecock Barracks, Nuneaton, Warwickshire.

Advertisement
Amentum rectangle