MARKS & SPENCER said hackers broke into its systems by tricking employees at a third-party contractor, skirting its digital defences to launch a cyberattack that will disrupt the retailer for months.
Giving the first details since disclosing the breach on April 22, chief executive Stuart Machin said all companies were vulnerable, and M&S had boosted its defences by trebling tech spending in the last three years. M&S has an IT contract with Tata Consulting Services. One source familiar with the matter told Reuters it was a means of access. TCS declined to comment. Machin declined to comment on TCS specifically when asked if it was the weak link.
“Unable to get into our systems by breaking through our digital defences, the attackers did try another route resorting to social engineering and entering through a third party rather than a system weakness,” he told reporters.
“Once access was gained, they used highly sophisticated techniques as part of the cyber attack.”
Machin declined to comment on any ransom demand, citing advice from government agencies and law enforcement.
M&S stopped online sales.
It said last Wednesday (21) they were unlikely to be fully restored until July.
Machin said M&S became aware of the breach when it spotted suspicious activity during the Easter weekend of April 19-20.
He said the time between the hackers gaining access and detection was “short”. Experts told the company that the average was 10 days and in some cases many months.
The National Crime Agency told the BBC the attack investigation was focused on a cluster of young, Englishspeaking hackers.
M&S, which has sales of nearly £14 billion a year, immediately called in experts, partners and authorities, Machin said.
Some 600 systems had been scanned for damage, he said, and they were gradually being brought back online.
