# Shelves, showrooms and assembly lines: what the M&S, Co-op and Jaguar Land Rover attacks taught us

> In 2025 a run of cyberattacks emptied shelves at the Co-op, froze M&S online sales for around six weeks and shut Jaguar Land Rover's production for weeks. The fridge attacks of 2026 are not a new category: they are the next step in a pattern where the target is the business's ability to operate. Here is what is reported, with the money.

Updated 2026-11-03 · Payaries · https://www.payaries.com/blog/retail-cyberattacks-ms-coop-jaguar-land-rover

## The cases

> **Written 3 November 2026.** From The Register, Computer Weekly, BleepingComputer and other outlets in 2025. Attribution in these cases is reported or claimed, not established in court. Payaries is a technology platform, not a security adviser. This article reports public information and is not legal or security-consulting advice. Facts in fast-moving stories change — read the primary sources linked below.

| Company | What was reported | Cost figure |
|---|---|---|
| Marks & Spencer (April–May 2025) | Online sales halted for around six weeks | M&S estimated about £300m profit impact (company estimate) |
| Co-op (2025) | Shelves emptied; the chief executive said data of all 6.5 million members was compromised | About £80m, per The Register |
| M&S and Co-op combined | Treated as one coordinated incident by the Cyber Monitoring Centre | £270m–£440m economic cost (independent estimate) |
| Jaguar Land Rover (autumn 2025) | Production disrupted for weeks | Cyber Monitoring Centre estimated almost £2bn (about £1.9bn) to the UK economy |

The first two figures measure different things: M&S's is a company's own profit estimate; the Cyber Monitoring Centre's are independent estimates of total economic cost. Do not add them together. Reports link the M&S and Co-op attacks to the group known as Scattered Spider, and those behind the M&S attack reportedly claimed the JLR hack too; the National Crime Agency only said it was working to understand the impact, and four suspects (three British, one Latvian) were arrested in connection with the retail attacks, per reports.

## The pattern: attackers aim at the operation, not the data

- **The target is time.** A retailer cannot sell and a factory cannot build while systems are down. Each day of downtime costs more than most ransoms, which is why attackers aim there.
- **Just-in-time is brittle.** Modern retail and manufacturing run on tight stock and orders placed by software. Take the software out and the shelf is empty within days.
- **Suppliers are targets too.** In May 2025 a ransomware attack on a UK chilled-food distributor, Peter Green Chilled, threatened supply to supermarkets (The Register); in June 2025 United Natural Foods, a major US grocery distributor, took systems offline during a suspected breach (SEC filing, per TIME).
- **Food and agriculture is now a hot sector.** Food and Ag-ISAC tracked 227 ransomware incidents in the sector from January to July 2026, up 62% on the same period in 2025 (per TIME).

The supermarket fridge attacks go one step further: they skip the encryption and the ransom and harm the stock itself. See [that story](https://www.payaries.com/blog/supermarket-fridge-cyberattacks-europe-2026).

## How attackers got in

M&S chairman Archie Norman told a UK parliamentary committee that attackers impersonated an M&S employee and persuaded the IT service desk, run by the outsourcer TCS, to reset a password (as reported by UK media); that is social engineering, not an exotic exploit. Verizon's 2025 Data Breach Investigations Report found third-party involvement in breaches doubled from 15% to 30% in a year. The weak link is usually a person or a partner, not the firewall, which is why [deepfakes](https://www.payaries.com/blog/deepfake-fraud-seeing-is-no-longer-believing) and cloned voices on help-desk calls are a rising worry. See [concentration risk](https://www.payaries.com/blog/concentration-risk-one-vendor-one-update-one-outage) for the third-party picture.

## Sources

- [Empty shelves, empty coffers: Co-op pegs cyber hit at £80m — The Register (25 Sep 2025)](https://www.theregister.com/2025/09/25/empty_shelves_empty_coffers_coop/)
- [Jaguar Land Rover attack to cost UK £1.9bn, say cyber monitors — Computer Weekly](https://www.computerweekly.com/news/366633395/Jaguar-Land-Rover-attack-to-cost-UK-19bn-say-cyber-monitors)
- [M&S and Co-op attacks a category 2 cyber hurricane — Computer Weekly](https://www.computerweekly.com/news/366626336/MS-Co-op-attacks-a-Category-2-cyber-hurricane-say-UK-expert)
- [Ransomware attack on food distributor spells more pain for UK supermarkets — The Register (20 May 2025)](https://www.theregister.com/2025/05/20/ransomware_attack_on_food_distributor/)
- [‘Unprecedented’ cyberattack targets French supermarket fridges — TIME](https://time.com/article/2026/10/13/france-cyber-attack-cybersecurity-refrigeration-supermarket-food-security/)

## Questions

**How much did the M&S cyberattack cost?**
M&S estimated about £300m of profit impact and halted online sales for around six weeks. The independent Cyber Monitoring Centre put the combined economic cost of the M&S and Co-op attacks at £270m–£440m.

**Who attacked Marks & Spencer and the Co-op?**
Reports link both to the group known as Scattered Spider. The National Crime Agency has arrested four suspects in connection with the retail attacks. Attribution of the Jaguar Land Rover attack rests on a claim by the group.

**Why do hackers target retailers and manufacturers?**
Downtime is immediately costly for them, which raises the pressure to pay or restore quickly, and they depend on many connected suppliers that give attackers more ways in.

## Try it

Run a real invoice before you commit: [Payaries — www.payaries.com](https://www.payaries.com/signup). Payaries is a multi-chain crypto payment gateway — https://www.payaries.com

## Keep reading

- https://www.payaries.com/blog/supermarket-fridge-cyberattacks-europe-2026 — Someone is hacking supermarket fridges: what we know about the attacks across Europe
- https://www.payaries.com/blog/concentration-risk-one-vendor-one-update-one-outage — One vendor, one update, one outage: how shared technology becomes shared risk
- https://www.payaries.com/blog/ransomware-economy-crime-as-a-business — The ransomware economy: how crime became a business, and what crypto has to do with it
- https://www.payaries.com/blog/how-to-defend-against-cyberattacks-what-works — How to defend against cyberattacks: the checklist that matches how attacks actually happen