Four people have been arrested in connection with the cyber attacks on British retailers Marks and Spencer, Co-op and Harrods, UK police said on Thursday.
The National Crime Agency said that the people — three men and a woman — were apprehended on suspicion of organising the attacks in April, which are expected to cost the retailers hundreds of millions of pounds in total.
The suspects were arrested at their homes in the West Midlands and London. Two of the men are 19, while another is aged 17 and the woman is 20, the NCA said.
The people are believed to be linked to the cyber criminal group Scattered Spider, according to a person with knowledge of the situation. The group, which targets the IT help desks of large companies, is thought to have been behind several high-profile data breaches, including at M&S.
Unlike some ransomware gangs, Scattered Spider is a loose group of affiliates. The group — characterised by cyber security experts as male, trash-talking, English-speaking fraudsters — typically steals data for the purpose of extortion.
Paul Foster, head of the NCA’s National Cyber Crime Unit, said the arrests marked a “significant step” in its investigation. “But our work continues, alongside partners in the UK and overseas, to ensure those responsible are identified and brought to justice,” he said.
The NCA declined to comment on the affiliation of those arrested. M&S thanked the NCA “for its diligent work on this incident”.
The Co-op said: “Hacking is not a victimless crime. Throughout this period, we have engaged fully with the NCA and relevant authorities and are pleased on behalf of our members to see this had led to these arrests today.”
M&S and the Co-op suffered shortages on their shelves as a result of the attacks. In a select committee appearance this week, M&S chair Archie Norman described the cyber attack as “traumatic”, saying it would take the retailer a while to rebuild its systems.
The retailer, Norman revealed, turned to the “muscle” of the US FBI agency to help it deal with the attack. He also publicly confirmed for the first time that M&S believed DragonForce, a group of largely Russian-speaking cyber criminals, was behind the attack. The group provides ransomware tools to other criminal gangs including Scattered Spider.