NCA arrest four for cyber attacks on M&S, Co-op and Harrods

Image courtesy NCA

Two males aged 19 another aged 17 and a 20-year-old female were apprehended in the West Midlands and London this morning on suspicion of Computer Misuse Act offences, blackmail, money laundering and participating in the activities of an organised crime group.

All four were arrested at their home addresses and had their electronic devices seized for digital forensic analysis.

They remain in custody for questioning by officers from the NCA’s National Cyber Crime Unit in relation to the three attacks, which took place in April this year.

Deputy Director Paul Foster, head of the NCA’s National Cyber Crime Unit, said: "Since these attacks took place, specialist NCA cybercrime investigators have been working at pace and the investigation remains one of the Agency’s highest priorities.

"Today’s arrests are a significant step in that investigation but our work continues, alongside partners in the UK and overseas, to ensure those responsible are identified and brought to justice.

"Cyber attacks can be hugely disruptive for businesses and I’d like to thank M&S, Co-op and Harrods for their support to our investigations. Hopefully this signals to future victims the importance of seeking support and engaging with law enforcement as part of the reporting process. The NCA and policing are here to help."

Today’s operational activity was supported by officers from the West Midlands Regional Organised Crime Unit and the East Midlands Special Operations Unit.

Kevin Robertson, CTO of Acumen Cyber, said: “The dawn raids by the NCA, supported by the FBI, confirm that even highly distributed extortion crews such as Scattered Spider can be unmasked when their forensic breadcrumbs are stitched together.

The group is alleged to have breached M&S on 17th April and the Co-op two weeks later before detonating DragonForce ransomware, inflicting huge losses against retailers.

"However, the wider threat persists. Scattered Spider’s operators excel at impersonating staff, tricking IT help-desks into password resets, then bypassing MFA through SIM-swap and adversary-in-the-middle phishing before exfiltrating data or deploying ransomware. 

"Organisations should seize this opportunity to harden identity paths: roll out phishing-resistant MFA, require out-of-band verification for help-desk resets, monitor impossible-travel and token-reuse signals and segment critical systems from ad-hoc remote-management tools.

"These arrests are a strategic win for law enforcement but the operational battle against identity-centric ransomware crews is far from over.”

Victims of cybercrime should use the Government’s Cyber Incident Signposting Site for direction on which agencies to report an incident to.