Published on · United Kingdom
Marks & Spencer: one password reset by deception and 46 days without online orders
On 17 April 2025 someone posed as one of the 50,000 people who work with Marks & Spencer and convinced an outside supplier to reset an employee's password. That led to a ransomware attack: online orders stopped for 46 days and a cost the company itself puts at about £300 million.
In 30 seconds
- A criminal posed as an employee and got an outside supplier to reset his password.
- With that password he got into the network: ransomware, online orders stopped for 46 days.
- The rule: no password is changed on request without a check agreed in advance.
- When
- Way in on 17 April 2025
- Who
- Marks & Spencer, United Kingdom
- How they got in
- Password reset by deception through a supplier
- How much
- About £300 million according to M&S
What happened
Marks & Spencer, one of the UK's biggest retail chains, was hit in April 2025 by a ransomware attack attributed to the DragonForce group. Online orders were stopped and some store shelves were left empty.
The company estimated the cost of the attack at about £300 million. Online clothing orders resumed after 46 days.
How they got in
Chairman Archie Norman told a UK parliamentary committee: the way in was on 17 April, through what is now called social engineering, in other words deception.
The criminals posed as one of the 50,000 people who work with the company and convinced an outside supplier to reset an employee's password. The supplier's name has circulated in the press but has not been confirmed.
Why this matters for a small business too
The person running IT for a small business is almost always external: a technician, an agency, the software supplier. If a convincing call or email is enough for them to change a password, anyone can become you.
No sophisticated attack is needed: just the right name and the right tone.
What to check in your business today
- Agree with whoever runs your IT how to verify someone asking for a password change: a call back to the number on file or an agreed code.
- Write into your supplier contract what they can do on their own and what only after your confirmation.
- Keep backups disconnected from the network, where ransomware cannot reach them.
- Prepare a plan to work a few days without systems: who to call, how to take orders, how to tell customers.