Fast Reaction by Co-op Blocked Ransom Fallout, Hackers Claim

A trio of British High Street retailers continue to recover from cyberattacks that disrupted online orders and resulted in stock shortages across major supermarkets.

See Also: 57 Tips to Secure Your Organization

The attacks disrupted operations at retailer and grocer Marks and Spencer, supermarket giant the Co-operative Group, which also offers insurance, legal and funeral services and London department store Harrods. The hits, which became apparent over April’s Easter holiday, appear to trace to a group of attackers who sometimes wield DragonForce ransomware and are affiliated with the cybercrime collective codenamed Scattered Spider. Also tracked as UNC3944, the group may now be setting its sights abroad.

The group “has a history of focusing their efforts on a single sector at a time, and we anticipate they will continue to target the sector in the near term,” John Hultquist, chief analyst of the Google Threat Intelligence Group, told Information Security Media Group. “U.S. retailers should take note.”

While M&S continues to face widespread disruption, Co-op said its stores should soon be back to normal and this may trace to how it initially responded to the attack.

“Following the malicious third-party cyberattack, we took early and decisive action to restrict access to our systems,” a spokesperson said Wednesday. “We are now in the recovery phase and are taking steps to bring our systems gradually back online in a safe and controlled manner.”

The Co-op on Wednesday previewed “improved stock availability in our food stores and online from this weekend,” saying it would see stores get fully restocked as quickly as possible. All of its stores can once again accept all forms of payment, including contactless, chip and PIN.

The DragonForce-affiliated hackers who claim to be behind the Co-op and M&S hits said they’d camped out in Co-op’s network for a substantial period of time and stolen data, but were spotted before they could crypto-lock systems.

“Co-op’s network never ever suffered ransomware,” the attackers told the BBC in what the network described as “a long, offensive rant.”

Co-op “yanked their own plug – tanking sales, burning logistics and torching shareholder value,” they claimed. Co-op has no shareholder value; it is member-owned.

Co-op taking IT systems offline after discovering hackers inside its network “was the right and smart thing to do,” British cybersecurity expert Kevin Beaumont said in a post to social network Mastodon.

“While I was at Co-op we did a rehearsal of ransomware deployment on point-of-sale devices with the retail team, and the outcome was a business-ending event due to the inability to take payments for a prolonged period of time,” he said. “So early intervention with containment was the right thing to do, 100%.”

Proactively taking systems offline still carried a cost.

Multiple media reports have continued to highlight sometimes empty shelves across the 2,500 food stores the Co-op operates. The organization’s supply of products to more than 5,100 other stores, including independently run Costcutter and Co-op’s wholesale business, Nisa, has also been disrupted. Rural communities, including in Scotland, have been especially hard hit by the shortfalls.

After the attack, the Co-op on May 5 warned members that attackers likely stole members’ personal data, including names, contact details – residential address, email address, phone number – and dates of birth. The company said passwords and financial details were not exposed.

All of the breached organizations are working with Britain’s National Cyber Security Centre, which is the nation’s incident-response lead.

Slower Recovery at M&S

Recovery is taking longer for M&S, with online ordering remaining offline. The attackers appeared to deploy ransomware on the company’s VMware ESXi servers.

Speaking anonymously, an employee who works at M&S headquarters told Sky News a full recovery might take “months.” The retailer “didn’t have any business continuity plan” designed to respond to a cyberattack, resulting in “pure chaos” in the aftermath of the incident.

Regardless, the retailer has been lauded for its clear communications during the crisis.

On Tuesday, Jayne Wall, who heads customer service for M&S, sent an email to all customers warning them that their personal data – including their name, contacts details, date of birth and online order history – may have been stolen in the attack. She said no financial information or passwords were exposed.

Wall warned customers to beware of scammers contacting them, claiming to be from M&S. “Remember that we will never contact you and ask you to provide us with personal account information, like usernames and we will never ask you to give us your password,” she said.

Bank of America Global Research on Tuesday estimated that the attack costs the retailer $57 million per week due to disruption in “online sales and in-store contactless payments.” The market researcher said it does expect the retailer to make a full recovery, albeit with a 7% reduction in its full-year earnings before interest and taxes.

Harrods Sees No Data Exfiltration

Beyond the Co-op and M&S, Harrods earlier this month said it “restricted internet access” to its site as a result of an attack against it.

Harrods said normal operations have resumed. A spokesperson told ISMG on Thursday that “as of today, based on the ongoing assessments of both external cyber experts and internal security specialists, it remains the case that we have not seen any evidence of data exfiltration relating to Harrods customers and are therefore not asking our customers to do anything differently at this point.”

Repeat Resilience Warnings

Seeing multiple major British retailers get taken down by ransomware-wielding attackers has led the government to urge organizations to take cyber resilience more seriously. “These attacks need to be a wake-up call for every business in the U.K.,” government minister Pat McFadden said, speaking earlier this month at the NCSC’s annual CyberUK conference.

Cybersecurity experts said the resilience message has remained loud and clear for many years, not least as ransomware attacks have surged since 2019. “We have had lots of wake-up calls yet all we do is hit the snooze button,” cybersecurity expert Brian Honan said, who heads Dublin-based consultancy BH Consulting.

Google’s Mandiant incident response group released hardening advice designed to counter the group and its regularly used tactics, which have included tricking IT help desks by pretending to be employees. “These actors are aggressive, creative and particularly effective at circumventing mature security programs,” Hultquist said. “They have had a lot of success with social engineering and leveraging third parties to gain entry to their targets.”

The relative success of the Co-op’s response is a reminder that when designing incident response plans, proactively deactivating parts of the IT estate may provide the best long-term outcome. “Have a plan for containment levers, and pull them if you get e-crime actors in your network,” Beaumont said. “If left unchecked, they will set things on fire.”