01The cases
| Company | What was reported | Cost figure |
|---|---|---|
| Marks & Spencer (April–May 2025) | Online sales halted for around six weeks | M&S estimated about £300m profit impact (company estimate) |
| Co-op (2025) | Shelves emptied; the chief executive said data of all 6.5 million members was compromised | About £80m, per The Register |
| M&S and Co-op combined | Treated as one coordinated incident by the Cyber Monitoring Centre | £270m–£440m economic cost (independent estimate) |
| Jaguar Land Rover (autumn 2025) | Production disrupted for weeks | Cyber Monitoring Centre estimated almost £2bn (about £1.9bn) to the UK economy |
The first two figures measure different things: M&S's is a company's own profit estimate; the Cyber Monitoring Centre's are independent estimates of total economic cost. Do not add them together. Reports link the M&S and Co-op attacks to the group known as Scattered Spider, and those behind the M&S attack reportedly claimed the JLR hack too; the National Crime Agency only said it was working to understand the impact, and four suspects (three British, one Latvian) were arrested in connection with the retail attacks, per reports.
02The pattern: attackers aim at the operation, not the data
- The target is time. A retailer cannot sell and a factory cannot build while systems are down. Each day of downtime costs more than most ransoms, which is why attackers aim there.
- Just-in-time is brittle. Modern retail and manufacturing run on tight stock and orders placed by software. Take the software out and the shelf is empty within days.
- Suppliers are targets too. In May 2025 a ransomware attack on a UK chilled-food distributor, Peter Green Chilled, threatened supply to supermarkets (The Register); in June 2025 United Natural Foods, a major US grocery distributor, took systems offline during a suspected breach (SEC filing, per TIME).
- Food and agriculture is now a hot sector. Food and Ag-ISAC tracked 227 ransomware incidents in the sector from January to July 2026, up 62% on the same period in 2025 (per TIME).
The supermarket fridge attacks go one step further: they skip the encryption and the ransom and harm the stock itself. See that story.
03How attackers got in
M&S chairman Archie Norman told a UK parliamentary committee that attackers impersonated an M&S employee and persuaded the IT service desk, run by the outsourcer TCS, to reset a password (as reported by UK media); that is social engineering, not an exotic exploit. Verizon's 2025 Data Breach Investigations Report found third-party involvement in breaches doubled from 15% to 30% in a year. The weak link is usually a person or a partner, not the firewall, which is why deepfakes and cloned voices on help-desk calls are a rising worry. See concentration risk for the third-party picture.
04Sources
- Empty shelves, empty coffers: Co-op pegs cyber hit at £80m — The Register (25 Sep 2025)
- Jaguar Land Rover attack to cost UK £1.9bn, say cyber monitors — Computer Weekly
- M&S and Co-op attacks a category 2 cyber hurricane — Computer Weekly
- Ransomware attack on food distributor spells more pain for UK supermarkets — The Register (20 May 2025)
- ‘Unprecedented’ cyberattack targets French supermarket fridges — TIME
Questions
- How much did the M&S cyberattack cost?
- M&S estimated about £300m of profit impact and halted online sales for around six weeks. The independent Cyber Monitoring Centre put the combined economic cost of the M&S and Co-op attacks at £270m–£440m.
- Who attacked Marks & Spencer and the Co-op?
- Reports link both to the group known as Scattered Spider. The National Crime Agency has arrested four suspects in connection with the retail attacks. Attribution of the Jaguar Land Rover attack rests on a claim by the group.
- Why do hackers target retailers and manufacturers?
- Downtime is immediately costly for them, which raises the pressure to pay or restore quickly, and they depend on many connected suppliers that give attackers more ways in.
Keep reading
- Someone is hacking supermarket fridges: what we know about the attacks across EuropeHackers pushed supermarket fridges and freezers to 50°C in France in October and across Belgium, Sweden, Ireland and Estonia on 2 November 2026. What happened, how, and why it matters.
- One vendor, one update, one outage: how shared technology becomes shared riskWhy the whole world depends on a handful of vendors, and what the July 2024 CrowdStrike outage and the doubling of third-party breaches in Verizon's report tell us.
- The ransomware economy: how crime became a business, and what crypto has to do with itRansomware is a business: affiliates, leak sites, negotiators. Chainalysis counts about $820 million paid in 2025 on 50% more attacks. Where crypto fits, and where it doesn't.
- How to defend against cyberattacks: the checklist that matches how attacks actually happenA short, evidence-based defence checklist for a business or shop: exposure, patching, MFA, backups, verification, supplier risk and payment controls, drawn from real 2024–2026 incidents.