In a turn of events revealing the fragile threads of digital trust, British retail giant Marks & Spencer (M&S) has fallen victim to a complex cyberattack that slipped past fortified defences not by brute force, but by human manipulation. The breach, now confirmed to have originated through a third party contractor, has left M&S grappling with operational disruption and suspended online services.
According to Chief Executive Stuart Machin of M&S, the attackers circumvented internal cyber barriers by exploiting employees at a contracted partner through social engineering tactics. “Unable to get into our systems by breaking through our digital defences, the attackers did try another route resorting to social engineering and entering through a third party rather than a system weakness,” he told reporters. Once inside, they deployed advanced tools and strategies to deepen their intrusion.
Though M&S maintains an IT partnership with Tata Consulting Services, Machin refused to identify the contractor involved or confirm if that relationship was exploited. TCS, meanwhile, offered no public response.
The breach was detected during the Easter weekend in April when suspicious activity was flagged. Swift action followed, involving cybersecurity professionals, technology partners, and law enforcement agencies. Machin noted that the time from the hackers gaining access to detection was relatively short, compared to an industry average of 10 days, and sometimes even months.
Despite this prompt response, the damage was enough to temporarily cripple M&S’s online operations, which are now expected to remain partially offline until at least July. Around 600 digital systems have been under review, each undergoing rigorous scrutiny before being safely brought back into operation.
In a bold counter to the rising tide of cyber threats, M&S has significantly ramped up its investment in digital resilience, tripling its tech spending over the past three years. Yet, as this breach illustrates, the human element remains a potent vulnerability even in the most guarded systems.
The National Crime Agency is reportedly looking into a network of young, English-speaking cyber actors in connection to the incident.
Also read: Viksit Workforce for a Viksit Bharat
Do Follow: The Mainstream formerly known as CIO News LinkedIn Account | The Mainstream formerly known as CIO News Facebook | The Mainstream formerly known as CIO News Youtube | The Mainstream formerly known as CIO News Twitter |The Mainstream formerly known as CIO News Whatsapp Channel | The Mainstream formerly known as CIO News Instagram
About us:
The Mainstream formerly known as CIO News is a premier platform dedicated to delivering latest news, updates, and insights from the tech industry. With its strong foundation of intellectual property and thought leadership, the platform is well-positioned to stay ahead of the curve and lead conversations about how technology shapes our world. From its early days as CIO News to its rebranding as The Mainstream on November 28, 2024, it has been expanding its global reach, targeting key markets in the Middle East & Africa, ASEAN, the USA, and the UK. The Mainstream is a vision to put technology at the center of every conversation, inspiring professionals and organizations to embrace the future of tech.
