{"id":294062,"date":"2025-04-30T10:25:55","date_gmt":"2025-04-30T10:25:55","guid":{"rendered":"https:\/\/news.talkwithrattan.com\/index.php\/2025\/04\/30\/who-are-scattered-spider-how-the-notorious-hackers-linked-to-ms-cyber-attack-work\/"},"modified":"2025-04-30T10:25:56","modified_gmt":"2025-04-30T10:25:56","slug":"who-are-scattered-spider-how-the-notorious-hackers-linked-to-ms-cyber-attack-work","status":"publish","type":"post","link":"https:\/\/news.talkwithrattan.com\/index.php\/2025\/04\/30\/who-are-scattered-spider-how-the-notorious-hackers-linked-to-ms-cyber-attack-work\/","title":{"rendered":"Who are Scattered Spider? How the notorious hackers linked to M&S cyber attack work"},"content":{"rendered":"
\"Who<\/div>


\n<\/p>\n

\n

M&S may have been hacked by a group of notorious cyber-criminals known as Scattered Spider, some of whom are believed to be English-speaking teenagers.<\/p>\n

For more than a week, the British retailer has been unable to accept contactless payments and customers are also unable to shop online.<\/p>\n

On Monday, Sky News reported that hundreds of agency workers at its main distribution centre<\/a><\/strong> were told to stay at home as M&S grappled with the attack.<\/p>\n

Shoppers also complained of empty shelves around the country, as M&S confirmed there were “pockets of limited availability in some stores” as a result of measures to manage the cyber incident<\/a><\/strong>.<\/p>\n

Who are Scattered Spider, the infamous group being linked to the attack?<\/strong><\/p>\n

“Scattered Spider is one of the most dangerous and active hacking groups we are monitoring,” said Graeme Stewart, the head of public sector at security company Check Point.<\/p>\n

“Since they first appeared in 2022, they have been linked to more than 100 targeted attacks across industries such as telecoms, finance, retail and gaming,” he said.<\/p>\n

In one of their most infamous hacks, members of the group locked up the networks of casino operators Caesars Entertainment and MGM Resorts International, and demanded hefty ransoms.<\/p>\n

Caesars paid the hackers about $15m (\u00a311.2m) to restore its network.<\/p>\n

\n
\n
\n

Please use Chrome browser for a more accessible video player<\/p>\n

<\/p>\n


\n 1:55<\/span>
\n <\/span><\/p>\n

\n

M&S still tackling cyberattack<\/span>
\n <\/figcaption><\/div>\n<\/p><\/div>\n

Who are the members of Scattered Spider?<\/strong><\/p>\n

“The group is made up of young, English-speaking individuals, mainly based in the UK and the US,” said Mr Stewart.<\/p>\n

Some members are believed to be as young as 16, with the group meeting up on hacker forums online.<\/p>\n

The authorities have a hard time catching Scattered Spider members because they are just that: scattered.<\/p>\n

“This is not a loose group of opportunistic hackers. They operate more like an organised criminal network, decentralised and adaptive.<\/p>\n

“Even with several arrests made in the US and Europe, their structure allows them to regroup quickly.”<\/p>\n

Last month, an alleged Scattered Spider member was extradited to the US from Spain and charged with offences including wire fraud and aggravated identity theft.<\/p>\n

\n
\n
\n \"An\n <\/div>
\n Image:<\/span>
\n Empty shelves in M&S in Aberdeen during the cyberattack. Pic: SponPlague
\n <\/span>
\n <\/figcaption><\/figure>\n<\/div>\n

How do they work?<\/strong><\/p>\n

The group often targets human vulnerabilities, according to Mr Stewart, rather than system flaws.<\/p>\n

They use tactics like social engineering, where hackers trick people into letting them into systems, impersonating IT staff or SIM swapping.<\/p>\n

SIM swapping attacks are where hackers trick phone providers into transferring a victim’s phone service to a SIM card under the hacker’s control.<\/p>\n

Read more from Sky News:<\/strong>
Ransacked and looted: Sky reporter returns to family home in Sudan<\/strong><\/a>
Trump celebrates 100 days in office<\/strong><\/a>
Sixteen-year-old detained after three people killed in Sweden<\/strong><\/a><\/p>\n

This means the hacker can approve two-factor authentication and access the victim’s private accounts as well as installing malware on certain devices.<\/p>\n

“The attack on M&S appears to be heavily financially motivated and focused on making as much money as possible,” said Jake Moore, global cybersecurity adviser at cybersecurity firm ESET.<\/p>\n

“The gained notoriety focused on the brand – which is so entrenched in British culture and history – just places even more pressure on M&S to pay the growing demands.”<\/p>\n

\n
\n
\n

Please use Chrome browser for a more accessible video player<\/p>\n


\n \"Global
\n
\n 1:14<\/span>
\n <\/span><\/p>\n

\n

‘Cybercrime costing world $9.2 trillion’<\/span>
\n <\/figcaption><\/div>\n<\/p><\/div>\n

What does M&S say?<\/strong><\/p>\n

Sky News contacted M&S which referred us to its previous statement.<\/p>\n

“As part of our proactive management of a cyber incident, we have made the decision to pause taking orders via our M&S.com websites and apps.<\/p>\n

“Our product range remains available to browse online. We are truly sorry for this inconvenience. Our stores are open to welcome customers.<\/p>\n

“We informed customers that there was no need for them to take any action. That remains the case, and if the situation changes we will let them know.”<\/p>\n<\/p><\/div>\n


\n
Source link <\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

M&S may have been hacked by a group of notorious cyber-criminals known as Scattered Spider, some of whom are believed to be English-speaking teenagers. For more than a week, the British retailer has been unable to accept contactless payments and customers are also unable to shop online. On Monday, Sky News reported that hundreds of […]<\/p>\n","protected":false},"author":2,"featured_media":294063,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"tdm_status":"","tdm_grid_status":"","fifu_image_url":"https:\/\/e3.365dm.com\/25\/04\/768x432\/skynews-marks-and-spencer-shop_6896501.jpg?20250425144859","fifu_image_alt":"","footnotes":""},"categories":[607],"tags":[2601,13320,9447,1109,13579,31690,14849,1396],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/news.talkwithrattan.com\/index.php\/wp-json\/wp\/v2\/posts\/294062"}],"collection":[{"href":"https:\/\/news.talkwithrattan.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news.talkwithrattan.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news.talkwithrattan.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/news.talkwithrattan.com\/index.php\/wp-json\/wp\/v2\/comments?post=294062"}],"version-history":[{"count":1,"href":"https:\/\/news.talkwithrattan.com\/index.php\/wp-json\/wp\/v2\/posts\/294062\/revisions"}],"predecessor-version":[{"id":294064,"href":"https:\/\/news.talkwithrattan.com\/index.php\/wp-json\/wp\/v2\/posts\/294062\/revisions\/294064"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news.talkwithrattan.com\/index.php\/wp-json\/wp\/v2\/media\/294063"}],"wp:attachment":[{"href":"https:\/\/news.talkwithrattan.com\/index.php\/wp-json\/wp\/v2\/media?parent=294062"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news.talkwithrattan.com\/index.php\/wp-json\/wp\/v2\/categories?post=294062"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news.talkwithrattan.com\/index.php\/wp-json\/wp\/v2\/tags?post=294062"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}