The incident was classified as a "Category 2 systemic event."
The April 2025 cyber attacks on UK retailers Marks & Spencer and Co-op were part of a single combined cyber event.
According to an assessment from the Cyber Monitoring Centre (CMC), it assessed the incidents as a single combined cyber event, reported The Hacker News. The CMC classified the incident as a "Category 2 systemic event," estimating financial losses between £270 million and £440 million.
Intrusions are believed to have been carried out by the cybercrime collective Scattered Spider, also known as UNC3944. Harrods was excluded from the CMC's assessment due to a lack of information.
"Given that one threat actor claimed responsibility for both M&S and Co-op, the close timing, and the similar tactics, techniques, and procedures, CMC has assessed the incidents as a single combined cyber event," the CMC said.
Written by
Dan Raywood is a B2B journalist with 25 years of experience, including covering cybersecurity for the past 17 years. He has extensively covered topics from Advanced Persistent Threats and nation-state hackers to major data breaches and regulatory changes.
He has spoken at events including 44CON, Infosecurity Europe, RANT Forum, BSides Scotland, Steelcon and the National Cyber Security Show, and served as editor of SC Media UK, Infosecurity Magazine and IT Security Guru. He was also an analyst with 451 Research and a product marketing lead at Tenable.
