Help Desk Impersonation, 46 Days, and £300 Million at M&S

This is a story about two timelines.

The first is short. Someone impersonating a Marks and Spencer employee contacted an IT help desk and asked for a password reset, according to BleepingComputer’s reporting. The help desk granted it. M&S has not said whether that request came by phone, which is how the group suspected of the attack often works (CISA, 2025).

The second timeline is long. It stretches from that initial access, which M&S’s chairman dated to April 17, through the Easter weekend disruptions in April, the ransomware detonation on April 24, the 46-day suspension of online orders, and the months of recovery that followed. In the week after M&S disclosed the incident, more than £500 million came off the company’s stock market value (The Guardian, April 29, 2025). When M&S later put a number on the damage, it estimated the hit to 2025/26 operating profit at about £300 million, before mitigation and insurance. Four people were eventually arrested.

The gap between those two timelines is the entire story. One help desk impersonation. Months of consequences. And a verification process that could not tell the difference between a real employee and someone pretending to be one.

The Impersonation

The precise details of the social engineering have not been made public. What we know comes from a combination of M&S’s own disclosures, reporting by BleepingComputer, Reuters, and the Financial Times, and statements from the UK’s National Crime Agency and National Cyber Security Centre.

M&S Chairman Archie Norman told a House of Commons committee in July 2025 that the initial entry came through social engineering. “As far as I can tell, that is a euphemism for impersonation, but it was sophisticated impersonation,” he said. He added that “part of the point of entry in our case also involved a third party,” without naming it. The Financial Times reported that Tata Consultancy Services, which ran M&S’s IT service desk, was investigating whether it had been the gateway. TCS says it found no indicators of compromise in its own network.

Scattered Spider, the group the National Crime Agency named as a focus of its investigation, is known for exactly this method. Their operatives are native English speakers, many of them young, who study corporate jargon, IT service management workflows, and the specific verification questions that target organizations use. They do not sound like outsiders. They sound like employees who happen to be having a frustrating day.

The CISA advisory on Scattered Spider (AA23-320A) documents their standard approach: impersonate an employee or IT staff member, contact the help desk, request a credential reset or MFA bypass. The call is designed to sound routine. The verification questions are answered correctly because the information needed to answer them can be pulled from social media, open sources, commercial intelligence tools, and database leaks (CISA, 2025). The agent follows the protocol because the protocol was satisfied.

From the help desk agent’s perspective, this would have looked like an ordinary call. An employee needing access. Verification questions answered. Request processed. Ticket closed.

That ticket became the entry point for one of the most disruptive retail cyberattacks in British history.

February to April: The Quiet Phase

Sources told BleepingComputer that the attackers may have first breached M&S as early as February 2025, about two months before the April 17 entry date the company’s chairman later gave Parliament. On BleepingComputer’s account, what followed was a patient, methodical escalation.

During this period, according to the same sources, the attackers stole the company’s NTDS.dit file. This is the core Active Directory database, the file that stores password hashes for every domain user in the organization. With this file in hand, the attackers could crack those hashes offline, extracting cleartext credentials for a range of accounts without triggering any alerts inside the network.

Active Directory is the nervous system of a Windows enterprise environment. It controls who can access what and under which conditions. Compromising it is the equivalent of stealing the master key ring for every door in the building. The attackers now had valid credentials. They could move laterally through the network. They could escalate privileges. And they could do all of this looking, to the system, like legitimate users.

If BleepingComputer’s sources are right, the attackers spent roughly two months inside M&S’s infrastructure. That fits Scattered Spider’s documented tradecraft: they lean on valid credentials and legitimate remote-access tools, which makes their activity harder to distinguish from normal operations.

On that account, while M&S employees went about their daily work, the attackers were mapping the network, identifying critical systems, and positioning themselves for the next phase.

Easter Weekend: The First Cracks

On April 19, the Easter long weekend, customers across M&S’s roughly 1,000 UK stores began noticing problems. Contactless card payments failed at some locations. Click and Collect orders could not be retrieved. Gift card services went down. The issues appeared intermittent and inconsistent, the kind of thing that could be mistaken for a routine technical problem.

On April 22, M&S issued a formal statement to the London Stock Exchange. The company acknowledged a “cyber incident” but stressed that stores remained open and that its website and app were still operational. It reported the breach to the National Cyber Security Centre and brought in external specialists. At this point, M&S told customers there was no need for them to take any action.

Behind the scenes, the situation was far more serious than the public disclosure suggested.

April 24: The Ransomware Detonation

On April 24, two days after the public disclosure, the attackers deployed DragonForce ransomware to M&S’s VMware ESXi hosts and encrypted the virtual machines on them, according to BleepingComputer’s sources.

The timing looks deliberate. The Easter weekend would have thinned staffing. The initial disclosure on April 22 had set an expectation that the situation was being managed. The ransomware detonation arrived when the organization was already stretched and partially reassured.

On April 23, M&S chief executive Stuart Machin received an email from DragonForce, sent from a compromised employee account, claiming the group had encrypted M&S’s servers and stolen customer data, and demanding payment (BBC, June 6, 2025).

On April 25, M&S suspended all online purchases through its website and mobile app. Customers could still browse the site but not buy. For a retailer that generates roughly one-third of its UK clothing and home sales through digital channels, this was an enormous operational hit. M&S’s online sales had averaged about £3.8 million a day (The Guardian, April 29, 2025).

The 46 Days

What followed was a slow, grinding recovery that stretched from late April through mid-June.

With its automated stock systems switched off, M&S reverted to manual processes. Staff tracked fresh food and clothing supplies with pen and paper. Shelves went partially bare. M&S told about 200 agency workers at its Castle Donington distribution center to stay at home (Reuters, April 28, 2025).

On May 5, BleepingComputer reported that the attacks on M&S and Co-op both started with attackers impersonating employees while contacting IT help desk staff, then persuading the help desk to reset those employees’ credentials. The UK’s National Cyber Security Centre advised companies to review how their help desks authenticate staff before resetting passwords.

On May 13, roughly three weeks after the initial disruption, M&S notified customers that personal data had been stolen in the attack. The compromised information included names, dates of birth, addresses, telephone numbers, and purchase histories. M&S stated that the data did not include usable card or payment details, or any account passwords.

On May 21, the head of the National Crime Agency’s cybercrime unit told the BBC that the agency was looking at Scattered Spider, among other hypotheses.

On June 10, after 46 days of suspended online sales, M&S resumed taking orders for some clothing lines. Recovery ran well past that: on July 8 the chairman told Parliament that M&S would be working to bring back or replace some background systems in October and November.

Over the summer, M&S replaced Tata Consultancy Services as its IT service desk provider, though TCS still supports other IT services. Both companies said the procurement behind the change began months before the attack. In July, the NCA announced the arrest of four individuals suspected of involvement in the M&S and Co-op attacks.

In its annual results presentation, M&S put the expected hit to 2025/26 operating profit at about £300 million, before mitigation and insurance. The Cyber Monitoring Centre, an independent non-profit body, classified the M&S and Co-op attacks as a single combined cyber event with a total financial impact estimated between £270 million and £440 million.

What the Numbers Do Not Capture

The financial figures tell one version of the story. The operational reality tells another.

For weeks, M&S store staff worked without the automated systems they relied on daily. Inventory tracking, stock replenishment, order fulfillment, and customer service workflows all reverted to manual processes. Employees who had been trained on digital systems found themselves managing supply chains with paper logs and phone calls. Customer-facing staff fielded questions they could not answer about order status, delivery timelines, and service restoration.

M&S sent about 200 agency warehouse workers home as distribution operations stalled. These were not corporate executives or IT staff. They were the people furthest from the breach and most directly affected by its operational consequences.

The customer data notification, when it came on May 13, added another layer. M&S emailed its online customers to say their names, addresses, dates of birth, phone numbers, and order histories could have been taken. M&S emphasized that the data held no usable payment details, but the reputational damage was already compounding. Trust in a 141-year-old retail brand does not break in a day, but it can erode over 46 of them.

And then there is the question nobody in the public reporting has answered: what happened to the help desk agent who processed the original reset? Their name has not been published. Their experience has not been documented. But somewhere in this story is a person who followed a process, did what they were trained to do, and became the unwitting entry point for an estimated £300 million hit to profit.

Not an Isolated Incident

M&S was not the only target. In the same period, UK retailer Co-op reported a cyberattack using similar tactics, and Harrods reported attempts to gain unauthorized access to some of its systems. The CMC classified the M&S and Co-op attacks as a single combined event, suggesting coordinated or sequential targeting by the same group.

Before the UK retail campaign, Scattered Spider had already demonstrated this playbook in the United States. The MGM Resorts breach in September 2023 began with a social engineering call to the company’s IT help desk. The Caesars Entertainment breach, disclosed the same month, followed a similar pattern. In both cases, the initial access came through social engineering of IT support, not through technical exploitation.

In June 2025, Google’s Threat Intelligence Group reported intrusions at US insurers that bore “all the hallmarks of Scattered Spider activity.” The group rotates sectors, but the core technique remains constant: call the help desk, satisfy the verification protocol, and walk through the front door.

The consistency of this pattern is itself the argument. This is not a one-off failure at a single organization. It is a systemic vulnerability in how enterprises verify identity over the phone. Every company that relies on knowledge-based verification at its help desk is exposed to the same impersonation that worked at M&S, at MGM, and at Caesars. The only variable is whether Scattered Spider, or someone who has studied their methods, decides to call.

What the Verification Protocol Could Not Do

Strip away the ransomware, the Active Directory compromise, the lateral movement, the data exfiltration, and the 46 days of operational disruption. Go back to the beginning. Go back to the help desk.

An attacker impersonated an employee. A help desk agent verified the requester using whatever protocol was in place. The protocol was satisfied. The reset was granted. Everything that followed was a consequence of that moment.

The agent did not fail. The protocol did not detect that the requester was not who they claimed to be. Whatever it checked, the impersonator could answer. M&S’s chairman told Parliament the attackers “appeared as an individual, with their details” (House of Commons evidence, July 8, 2025). The same outcome has been documented at MGM Resorts, at Caesars Entertainment, and at dozens of other organizations targeted by the same group using the same method.

Scattered Spider does not defeat verification protocols. They satisfy them. This is the distinction that matters, and it is the distinction that most post-incident analyses still do not adequately address.

The group’s operatives succeed because knowledge-based verification assumes that the answers to its questions are private. They are not. LinkedIn profiles, corporate websites, conference bios, SEC filings, data broker sites, and social media posts collectively provide enough information to answer most standard help desk verification questions for any named employee at any public-facing organization.

Add AI voice cloning to the mix, and the problem deepens further. Pindrop measured a rise of more than 1,300% in deepfake fraud attempts during 2024, from about one a month to seven a day, across the 1.2 billion calls it analyzed (Pindrop, Voice Intelligence & Security Report, 2025). McAfee researchers produced a clone with an 85% voice match from three seconds of audio in one test (McAfee Labs, 2023).

The help desk agent who processed the reset was operating a verification system that could not reliably distinguish a legitimate employee from a well-prepared impersonator. The impersonator passed its checks, and the system processed a reset that opened the door to an estimated £300 million hit to profit.

The Arithmetic of One Reset

Consider the proportions.

The total cost to execute the initial access was effectively zero.

The resulting damage: an estimated £300 million hit to profit. More than £500 million off M&S’s market value in the first week. 46 days of suspended online sales. Customer personal data taken. Manual operations across its UK stores. Agency warehouse staff sent home. Four arrests. Regulatory scrutiny. Months of reputational repair.

The return on investment for the attacker, measured in damage-per-minute-of-effort, is staggering. There is no other attack vector in enterprise security that offers this ratio. A single help desk request, answered by a well-meaning agent following a protocol that could not do what it was designed to do, produced cascading failure across one of the UK’s largest retailers.

This is not a story about a sophisticated technical exploit. No zero-day vulnerability was used. No advanced malware was required for initial access. The attacker impersonated an employee, satisfied the help desk, and walked through the front door.

The sophistication came later, in the lateral movement and the ransomware deployment. But the entry point was a conversation. And the only thing that could have stopped it was a verification system that did not rely on the conversation to determine identity.

What the Verification System Should Have Required

If the help desk had required the caller to verify their identity through an out-of-band challenge on their physical device, the password reset would not have been granted. The caller could have known every answer to every question. They could have sounded exactly like the employee they were impersonating. None of it would have mattered.

Out-of-band, device-bound identity verification moves the proof of identity out of the phone call entirely. The verification happens on a device the attacker does not possess, through a channel the attacker does not control. The help desk agent is no longer making a judgment call about whether the caller sounds right. The system makes the determination using something that cannot be researched, rehearsed, or cloned.

This is the architectural fix. Not better training for help desk agents, though training is valuable hygiene. Not more knowledge-based questions, though reducing unnecessary exposure of personal data is good practice. The fix is removing the decision from the communication channel where the attacker operates and placing it in a channel where only the legitimate employee can respond.

The technology exists today. Identity Impersonation Detection systems verify callers through government-issued ID on devices, with protections against SIM swaps, man-in-the-middle attacks, and replay attempts. No pre-registration is required. The verification happens in the moment, outside the call.

M&S brought in external cybersecurity specialists during the incident and has since changed IT service desk providers, in a procurement both companies say began before the attack. The company has not publicly disclosed what changes it has made to its help desk verification process.

Where It Started

The M&S breach will be studied for years. It will appear in CISO presentations, in board risk briefings, in insurance underwriting models, and in security awareness training modules. The numbers are too large and the method too simple for it to be ignored.

But the lesson that matters most is the one at the very beginning, before the ransomware, before the Active Directory compromise, before the 46 days of darkness.

Someone contacted a help desk. They passed its checks. They got a password reset.

Knowledge-based questions were the right ones to ask in a world where the answers were private. That world is gone. The questions remain. And organizations that have not updated their verification architecture to account for this reality are exposed to the same impersonation that worked at M&S, at MGM, at Caesars, and at every other company where Scattered Spider has picked up the phone.

The damage will take years to fully measure. The fix is architectural. And it starts with a question that most organizations still have not answered: when someone contacts your help desk and says they are who they claim to be, what exactly do you have that proves it?

Sources

M&S Annual Results Presentation (2025) · M&S London Stock Exchange Disclosure (April 22, 2025) · BleepingComputer M&S Breach Reporting (April-June 2025) · Reuters M&S Cyberattack Coverage · Financial Times M&S/TCS Reporting · UK National Crime Agency Statements (May-July 2025) · UK National Cyber Security Centre Advisory · CISA Scattered Spider Advisory AA23-320A (updated July 2025) · Pindrop 2025 Voice Intelligence & Security Report · Cyber Monitoring Centre Classification Assessment (June 2025) · Archie Norman, Oral Evidence to the House of Commons Business and Trade Sub-Committee, HC 835 (July 8, 2025)