Marks & Spencer ransomware attack via impersonation of a third-party user
M&S disclosed a cyber incident on April 22, 2025 that halted online orders for weeks. Chairman Archie Norman told MPs on July 8, 2025 that the attackers entered on April 17 through a sophisticated impersonation of one of the retailer's third-party users, and that M&S detected them two days later. The DragonForce ransomware group claimed the attack.
- Victim
- Marks & Spencer
- Industry
- Retail and e-commerce
- Country
- United Kingdom
- Intrusion began
- Apr 17, 2025
- First disclosed
- Apr 22, 2025
- Actor
- DragonForce (claimed); widely linked to Scattered Spider (Extortion group)
- Initial access
- Help desk social engineering
- Identity control that failed
- Identity lifecycle
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- M&S estimated an impact of about GBP 300 million on 2025/26 group operating profit before cost mitigation, insurance and trading actions (full-year results, May 21, 2025). Not converted to USD.
The identity lesson
The attackers talked their way into a legitimate identity rather than breaking a control. Identity verification for password and MFA resets that cannot be satisfied with personal details, applied to outsourced service desks as well as in-house staff, is the control that matters here.
Go deeper on SWI
Sources
- M&S says April cyberattack caused by 'sophisticated impersonation' of third-party, Irish Examiner (Reuters), Jul 8, 2025
- M&S confirms social engineering led to massive ransomware attack, BleepingComputer, Jul 8, 2025
- M&S estimates £300m hit to operating profit from recent cyberattack, Reinsurance News, May 21, 2025
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Caesars Entertainment loyalty database theft via IT support vendor 2023 · Help desk social engineering
- MGM Resorts help desk social engineering and ransomware 2023 · Help desk social engineering
- Help desk resets of Okta super administrator MFA at multiple customers 2023 · Help desk social engineering
- Clorox intrusion after outsourced help desk reset passwords and MFA 2023 · Help desk social engineering
Cite this record
SWI Community Team. (2026). Marks & Spencer ransomware attack via impersonation of a third-party user. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2025-marks-and-spencer-third-party-impersonation/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.