Four individuals have been arrested in connection with a series of cyberattacks on Marks & Spencer that forced the retailer to suspend online sales earlier this year, resulting in estimated losses of £300 million.
Officers from the National Crime Agency (NCA), working in conjunction with local police forces, made the arrests early on Thursday morning. The attacks have been linked to a cybercrime group known as Scattered Spider.
Those detained include a 17-year-old British boy and a 19-year-old Latvian man in the West Midlands, a 19-year-old British man in London, and a 20-year-old British woman in Staffordshire. All four were arrested on suspicion of conspiracy to commit unauthorised access to computer systems with intent to commit further offences, blackmail, money laundering, and involvement in organised crime. Digital devices were seized during the operation, and the suspects remain in custody.
Paul Foster, head of the NCA’s National Cyber Crime Unit, said:
“Since these attacks took place, specialist NCA cybercrime investigators have been working at pace and the investigation remains one of the Agency’s highest priorities. Today’s arrests are a significant step, but our work continues — both in the UK and with international partners — to identify all those involved and bring them to justice.”
Earlier this week, the chair of Marks & Spencer revealed that two cyber-attacks targeting “large British companies” had gone unreported in recent months, raising concerns about transparency and cyber threat disclosure in the corporate sector.
