Marks & Spencer forewarns a cyber-attack in April will result in a significant $400 million cut to their earnings
## Recent Cyberattacks on Retailers: A Global Concern
Retailers across the globe are facing a surge in cyberattacks, with several major incidents reported in recent weeks. In the United States, a series of attacks has disrupted operations and caused significant financial losses for various retailers.
### U.S. Retailers Under Siege
The most recent wave of cyberattacks has affected several U.S. retailers, including United Natural Foods (UNFI), a primary distributor for Whole Foods, which experienced a significant cyberattack that disrupted its electronic ordering systems, leading to product shortages at Whole Foods and other grocery stores across the country. By June, UNFI had made progress in restoring its systems[1][2][3].
Victoria's Secret and The North Face also fell victim to cyberattacks, forcing them to pause online orders and temporarily shut down their websites, respectively[1][2]. Cartier was also targeted, though the extent of the breach has not been disclosed[1][4].
### The Threat of Scattered Spider
Google threat intelligence researchers have warned that the group Scattered Spider, known for hacking MGM Resort in 2023 and breaching Harrods and Co-op in the U.K. between mid-April and early May, is now targeting U.S. retailers[1]. The cyberattack disclosed by Marks & Spencer in April is believed to be the work of the cybercrime gang Scattered Spider[2].
### The Impact on Marks & Spencer
Marks & Spencer in the U.K. has been affected by a cyberattack that has disrupted online transactions and will continue to do so through July. The company proactively took down some of its systems to protect them, resulting in short-term disruptions[2]. The financial impact of the cyberattack on Marks & Spencer is a preliminary tally of $400 million (300 million British pounds), which is a significant blow to the company's group operating profits[2].
### Preparing for and Recovering from Cyberattacks
Experts recommend that retailers enhance their defenses, especially against social engineering attacks, and vet third-party providers more thoroughly[1][3]. Fundamental steps taken ahead of time can help organizations prepare for and recover from cyberattacks faster, according to Allie Mellen[2].
The distraction caused by dealing with a major breach can create an opportunity cost, delaying or canceling new initiatives and launches, and causing the business to be significantly behind in its plans, as stated by Jo Joyce, a partner who co-leads the U.K. and Ireland cyber law practice at Taylor Wessing[2].
M&S may face long-term effects from the attack, according to legal experts. To prevent another disruption, the company plans to accelerate a technology improvement plan from a two-year time frame to a six-month time frame[2].
### Global Implications
While Marks & Spencer in the U.K. was affected by a cyberattack, the broader trend shows that retailers worldwide are under increased threat from cyber actors[2]. The current status of cyberattacks targeting U.S. retailers is concerning, with several major incidents reported in recent weeks.
Cybersecurity Dive offers a free daily newsletter to keep up with the story. For more information and updates on cybersecurity threats and best practices, subscribe today.
- The recent cyberattacks on retailers, such as the one United Natural Foods experienced, have disrupted operations and caused financial losses, underscoring the need for robust cybersecurity measures in businesses worldwide.
- In the face of escalating threats, it's crucial for retailers to invest in threat intelligence and privacy protection, as the unknown extent of the breach targeted at Cartier highlights.
- The financial impact of such cyberattacks can be substantial, as demonstrated by Marks & Spencer's estimated loss of $400 million due to its current disrupted online transactions.
- In the technology-driven modern business landscape, strengthening cybersecurity is not just about recovery—it's also about keeping pace with competition and avoiding the opportunity costs that come with a distracted focus on addressing security breaches.
