UK Retail's Spring Attacks Started Where Help Desks Get Talked Into a Reset
Two household retailers, one combined event in the CMC's accounting, and an entry path that looks like a phone call to IT.
On April 30, 2025, Reuters reported that the Co-op had shut down some back-office and call-centre systems after hackers tried to break in. Stores and online trading continued. The attempt followed the incident already underway at Marks & Spencer.
On June 20, 2025, the Cyber Monitoring Centre published its assessment. It treated the M&S and Co-op ransomware incidents as one Category 2 systemic event because one threat actor claimed both, the timing was close, and the tactics matched. The CMC estimated total financial impact across affected parties at £270 million to £440 million. It did not include Harrods, citing too little information. It said the initial access appeared to involve social engineering, with reports of compromised credentials and abuse of IT help-desk processes. It also said it had not included ransom payments, because it did not have evidence that a ransom was or was not paid.
The help desk is an access path
A help desk that can reset a password, or re-enroll a device, is part of your identity system. Attackers do not need a new exploit if they can persuade that desk the caller is an employee who lost a phone. The device side of the same trick is physical: a stolen laptop plus a convincing call.
Tighten both. Require a callback to a number you already have on file. Refuse remote resets that arrive with a story and no second factor. And when a laptop is reported stolen, wipe it rather than only unlocking a new session for whoever calls next. That sequence is why help-desk resets and stolen devices belong in one runbook. DriveStrike covers the wipe and lock. It does not train the person wearing the headset. You still have to do that.
What the CMC number is, and is not
The £270–£440 million range is the CMC's estimate of financial impact, built from public and commercial data up to June 10, 2025, with assumptions about recovery after that date. It is not an M&S filing, and it is not a ransom figure. Quote it as an estimate from that statement.
Spearstone can help put the device half of this runbook in place. DriveStrike trials are the fastest way to see wipe and lock on hardware you already own.
Keep reading
- M&S Told Customers Personal Data Was Taken. Passwords Were Not.
- Verizon's 2025 DBIR: Almost Half of Those Infostealer Logins Sat on Unmanaged Devices
Questions worth answering directly
Did the CMC say M&S and Co-op were the same event?
It assessed them as a single combined cyber event based on a shared claim of responsibility, close timing, and similar tactics. It excluded Harrods from that assessment for lack of information.
What entry path did the CMC describe?
Social engineering, with reports suggesting compromised credentials and potential abuse of IT help-desk processes.