Google Warns: Hackers who have crippled Marks & Spencer online stores since 15-plus days in UK are now targeting American stores

Alphabet's Google has reportedly issued a stark warning to United States retailers, indicating that the cybercriminal group responsible for the recent crippling disruptions of major UK businesses is now setting its sights stateside. The alert comes as British retail giant Marks & Spencer (M&S) continues to grapple with the fallout of a significant cyberattack that has paralyzed its online operations for three weeks. M&S, a household name in the UK, saw its online order system grind to a halt on April 25th. The disruption has had a tangible impact on the company, with its share price plummeting by 15% since the Easter weekend, when initial order issues surfaced. Despite its 1,000 physical stores remaining open, the ongoing suspension of online orders highlights the severity of the attack and the challenges in restoring normal services.

While M&S has not officially confirmed the nature of the attack, multiple reports suggest the retailer fell victim to a ransomware attack. This type of cyber intrusion involves criminals gaining unauthorized access to a company's computer systems, encrypting crucial data, and demanding a ransom payment in exchange for the decryption key and the restoration of access.

What Google's warning to retailers says
Google's cybersecurity analysts are now raising concerns that this wave of attacks is poised to cross the Atlantic. As reported by Reuters, John Hultquist, an analyst at Google's cybersecurity arm, issued a direct warning in an email on Wednesday, stating, "US retailers should take note. These actors are aggressive, creative, and particularly effective at circumventing mature security programs."

Hultquist identified the likely culprit as a group connected to "Scattered Spider," a loosely organized network of hackers with varying skill levels. This group is widely believed to be behind the disruptive attack on M&S.

Scattered Spider: Hacker group that has likely targeted M&S
"The Scattered Spider-connected group has a history of focusing on a single sector at a time and is likely to target retail for a while longer," Hultquist cautioned, emphasizing the immediate threat to US businesses in the same industry.

Scattered Spider has established a track record of high-impact cyberattacks on both sides of the Atlantic. In 2023, the group gained notoriety for successfully breaching the security defenses of major casino operators MGM Resorts International and Caesars Entertainment, causing significant operational disruptions and financial losses.

Law enforcement agencies have faced considerable challenges in effectively combating hackers linked to Scattered Spider. This is partly attributed to the group's decentralized and fluid structure, the relatively young age of some of its members, and a reported reluctance among some cybercrime victims to fully cooperate with investigations, as previously reported by Reuters.

Despite these challenges, the US retail sector appears to be on high alert. Christian Beckner, a vice president with the National Retail Federation, affirmed to Reuters that his members are acutely aware of the potential for disruptive intrusions from Scattered Spider-linked groups.

"We've been closely tracking everything going on in the UK over the past few weeks," Beckner stated. "There aren't geographic boundaries on these threats."

Google's warning serves as a critical call to action for US retailers to urgently review and strengthen their cybersecurity defenses in the face of this evolving and aggressive threat. The ongoing struggles of M&S underscore the significant financial and reputational damage that can result from such attacks, highlighting the imperative for proactive measures and vigilance within the industry.