Safeguard your business against attacks like M&S, Harrods and Co-op

In recent months, major UK retailers (Marks & Spencer, Harrods and Co-op among them) have all fallen victim to sophisticated cyber attacks. The headlines focus on the household names. The lesson is for everyone else.

These were not crude smash-and-grabs. They were patient, targeted operations: reconnaissance, a foothold, escalation, and only then the disruption that made the news. By the time an attack is visible, the attacker has usually been inside for weeks.

What the retail attacks have in common

• A quiet beginning. The initial compromise (a phished credential, an exposed service, a supplier’s weakness) rarely triggers an alarm.
• Movement, not smash-and-grab. Attackers move laterally, map the network and identify what hurts most to lose.
• Timing for maximum pressure. Encryption or exfiltration is timed to force a fast, expensive decision.

What to do before it happens

Resilience is built in the quiet periods, not during the crisis.

1. Know your exposure. Test and probe your own systems and policies the way an attacker would, before an attacker does.
2. Rehearse the response. An incident plan that has never been run is a document, not a capability. Simulate it.
3. Preserve the ability to investigate. Logging, retention and clean backups are what let you establish what happened and prove it later.

When an incident strikes

Our work begins where confusion takes hold: identifying what happened, how it happened, and how to stop it happening again. We contain the damage, preserve the evidence with full chain-of-custody, and produce findings that stand up to scrutiny, from the boardroom to the courtroom.

The businesses that come through a cyber attack well are rarely the ones that were never targeted. They are the ones that were ready.

Concerned about your exposure? Start a conversation, in confidence.