Three teenage boys and a 20-year-old woman have been arrested following a series of cyberattacks on major UK retailers including M&S, Co-op and Harrods.
The National Crime Agency (NCA) said the suspects were detained early Thursday morning across the West Midlands, London and Staffordshire. They remain in custody on suspicion of offences including unauthorised access to computer materials, blackmail, money laundering, and involvement in organised crime.
The arrests mark a major development in one of the most disruptive waves of cybercrime to hit UK retail this year. The hacks – believed to be linked to the cybercrime group known as Scattered Spider – forced M&S to suspend online orders for six weeks, costing the business an estimated £300m.
Retailers were quick to praise law enforcement’s efforts. An M&S spokesperson said: “We welcome this development and thank the NCA for its diligent work on this incident.”
A Co-op spokesperson added: “Hacking is not a victimless crime. Throughout this period, we have engaged fully with the NCA and relevant authorities, and are pleased on behalf of our members to see this had led to these arrests today.”
The attacks, which also targeted Harrods, disrupted online platforms and internal systems across the sector, compounding concerns over the retail industry’s digital security amid rising threats.
Paul Foster, head of the NCA’s National Cyber Crime Unit, said: “Today’s arrests are a significant step in that investigation but our work continues… to ensure those responsible are identified and brought to justice.”
Norman described the attack as “traumatic” and told MPs earlier this week that the retailer had worked with both the National Cyber Security Centre and the FBI in response.
He revealed that M&S believes the cyberattack was carried out by a ransomware group known as DragonForce, which is thought to be based in Asia, and said the business deliberately avoided engaging with the attackers directly.
“It is apparent to us that quite a large number of cyber attacks never get reported,” Norman added. “We think that’s a big deficit in our knowledge as to what is happening.”
Retail leaders have repeatedly called for greater police resourcing and mandatory reporting of cyberattacks. Norman said: “We have reason to believe that two major cyber attacks in the last four months have gone unreported.”
Click here to sign up to Retail Gazette‘s free daily email newsletter
