Brutkey

Kevin Beaumont
@GossiTheDog@cyberplace.social

Marks and Spencer’s CEO says half of their online ordering is still offline after their ransomware incident, they hope to get open in next 4 weeks.

They are also rebuilding internal systems and hope a majority of that will be done by August.

Lesson: mass contain early. M&S didn’t. Co-op did.

https://www.reuters.com/business/retail-consumer/ms-ceo-most-cyberattack-impact-will-be-behind-us-by-august-2025-07-01/

Kevin Beaumont
@GossiTheDog@cyberplace.social

17 and two 19 year old teens picked up over Co-op and M&S hacks, and a 20 year old woman.

Pretend to be surprised.

https://www.bbc.com/news/articles/cwykgrv374eo

Kevin Beaumont
@GossiTheDog@cyberplace.social

If you ever doubted the link between Scattered Spider(tm) and LAPSUS$ - one of the people arrested today was a key part of the LAPSUS$ attacks a few years ago.

Kevin Beaumont
@GossiTheDog@cyberplace.social

After almost 3 months, Marks and Spencer recruitment system came back online just now. First 4 jobs posted.

Kevin Beaumont
@GossiTheDog@cyberplace.social

. @briankrebs@infosec.exchange has broken the story that the key member (and teenager) of LAPSUS$ runs Scattered Spider

https://krebsonsecurity.com/2025/07/uk-charges-four-in-scattered-spider-ransom-group/

Kevin Beaumont
@GossiTheDog@cyberplace.social

Co-op finally admitted the entire membership database was stolen

I had this in the thread months ago, they originally tried to deny it entirely then tried to say ‘some’ data was accessed when they knew it was the whole thing.

https://www.bbc.co.uk/news/articles/cql0ple066po

Kevin Beaumont
@GossiTheDog@cyberplace.social

Personally I think Co-op did a really good job getting out of that situation and minimising impact.

I definitely think if you have a LAPSUS$ style advanced persistent teenagers situation, tilt towards open and honest comms as those kids will use secrecy against ya. It’s 2025, it’s okay to say you got hacked, people largely understand. Also, in IR, lawyers are usually stuck in 1980 advice - it’s just advice, they ain’t yo boss.

Kevin Beaumont
@GossiTheDog@cyberplace.social

The people arrested as part of the Co-op and M&S hack investigation have been released on bail.

https://nation.cymru/news/four-people-bailed-after-arrests-over-cyber-attacks-on-ms-co-op-and-harrods/

Previously when this happened with LAPSUS$, they just continued hacking stuff.

Kevin Beaumont
@GossiTheDog@cyberplace.social

I understand the people released have not been charged.

Kevin Beaumont
@GossiTheDog@cyberplace.social

M&S still working on system recovery. https://www.bbc.com/news/articles/cewyyjdzql4o