Last week, we alerted you to the major cyber attacks impacting retail giants Marks & Spencer and the Co-op – incidents that underscored just how vulnerable even the biggest names can be when cyber criminals strike. Now, further developments have emerged, shedding more light on the scale of the breach and offering crucial lessons for all businesses.
So, what’s new – and what should you be doing differently in light of it?
M&S takes the biggest hit
Of the two, Marks & Spencer has experienced the most severe impact. While the company has yet to officially confirm the cause, it’s widely believed to be a ransomware attack – a method increasingly favoured by cyber criminals looking to encrypt data and extort money in return.
Here’s what we now know:
- Website and app orders were paused for over a week
- Click-and-collect and contactless payments were disrupted
- Stock availability suffered in several stores
- The company’s market value dropped by millions
Even more concerning, M&S has now confirmed a data breach involving personal customer information. The stolen data could include:
This isn’t just a tech issue – it’s a major data protection and reputational crisis.
Co-op incident reveals broader impact of supply chain breach
Co-op was also affected, and the incident has turned out to be more serious than first reported. Although retail stores and funeral services stayed open, the breach disrupted internal systems and led to the unauthorised access of personal data belonging to a significant number of current and former members. It also caused operational challenges, including delays in stock management that left some store shelves empty, highlighting how digital disruptions can have very visible consequences on the shop floor.
Both Co-op and other affected organisations are believed to have been compromised through the same third-party software provider. This underlines the growing risk of supply chain vulnerabilities, which can allow attackers to slip through less visible backdoors.
These were not direct attacks on the businesses’ own systems. They came through trusted partners, which is precisely what makes this type of threat so difficult to anticipate and contain.
What can businesses learn?
At Neuways, we’ve seen first-hand how fast a breach in one part of your supply chain can ripple out into your own systems. Even if your cyber security is top-tier, you’re only as secure as your weakest third-party connection.
Here are some key actions to take now:
- Assess your supplier risk – Know which partners have access to your systems or data, and ensure they meet robust security standards.
- Adopt Zero Trust principles – Don’t assume any system or user is safe by default.
Update your incident response plan – Could you contain a breach quickly if one occurred today?
- Run regular phishing and cyber security training – Educate your team to avoid being the entry point.
- Implement endpoint detection and response (EDR) – Detect threats early, especially those that bypass traditional defences.
Final Thoughts
The M&S and Co-op breaches are more than headlines – they’re real-time case studies in how modern cyber threats operate. And the message is clear: It’s not just about your defences anymore – it’s about everyone you’re connected to.
If you’re concerned about your supply chain risk or want to tighten up your cyber resilience, Neuways is here to help. From risk assessments to proactive threat monitoring, we’ve got the tools to keep your business secure in an increasingly unpredictable digital world.