Retail threat intelligence report — 27 April – 3 May 2026

• Reference: TI-2026-0504-004 (public edition)
• Sector: Retail
• Reporting period: 27 April – 3 May 2026
• Issued: 4 May 2026 · Lead analyst: P. Bassill (SOC Lead) · Reviewed by: SOC Reviewing Analyst

This is the public (TLP:CLEAR) edition of an intelligence product written by the UK Cyber Defence Security Operations Centre for its clients. Observations specific to individual client environments have been removed. Clients receive the full edition, including estate-specific indicators and detection content.

1. Executive summary

The retail vertical continues to operate in the wake of the Marks & Spencer / Co-op / Harrods cyber-attack wave of spring 2025, which has been classed as a Category 2 cyber-event with combined cost estimates of £270m–£440m. The Scattered Spider / DragonForce affiliate cluster is the proximate threat-actor cluster of greatest concern. The reporting period continues to surface helpdesk social-engineering tradecraft against UK retail support operations and sustained Qilin / Akira / DragonForce leak-site activity.

Key Judgements

1. It is highly likely that the Scattered Spider / DragonForce affiliate cluster will continue to target UK retail support operations through helpdesk social engineering and identity-provider compromise over the next reporting cycle. (HIGH confidence)

2. It is likely that retail point-of-sale and e-commerce platforms operating shared payment / loyalty SaaS will continue to be attractive Cl0p / ShinyHunters data-extortion targets. (MEDIUM-HIGH confidence)

3. It is likely that the operational and regulatory cost of the M&S / Co-op campaign (£270m–£440m, ICO engagement) will drive significant retail-sector defensive investment over the next 12 months, particularly in identity controls and helpdesk procedure. (HIGH confidence)

4. There is a realistic possibility that Citrix NetScaler CVE-2026-3055 / 4368 exploitation will affect retail-sector edge appliances within the next two reporting cycles. (MEDIUM confidence)

2. Sector threat landscape

The economic dimension of the spring-2025 wave has been substantial. Combined direct, recovery, and lost-trading costs across the M&S, Co-op and Harrods incidents are estimated in the £270m–£440m range, with the events classed as a Category 2 cyber-event by UK industry experts. M&S customer personal data (names, addresses, order histories) was exfiltrated; Co-op confirmed access to current and past members' data with the actor claim of 20 million records reaching the press, although Co-op did not confirm that figure. Payment data and passwords were not accessed in the M&S incident on the company's public timeline.

Beyond the named retailers, ransomware leak-site activity against the wider retail and hospitality vertical continued at sustained tempo through April 2026. Qilin (103 postings) led globally, Akira (48) and LockBit (39) maintained strong tempo, and DragonForce continued to move up the leaderboard. ShinyHunters and WorldLeaks pure-data-extortion postings continued to surface retail e-commerce victims operating shared loyalty / payment SaaS platforms.

The geopolitical dimension is secondary in the vertical: hacktivist DDoS against UK retail public-facing storefronts continues at low operational tempo and is meaningfully less material than organised-criminal ransomware and helpdesk social engineering. The UK Cyber Security Breaches Survey 2025/2026 confirms phishing as the most common (38%) and most disruptive incident type across UK businesses generally.

3. Key threat actors

The following actors are assessed to pose the most significant threat to organisations within the named vertical during the reporting period.

4. Tactics, techniques and procedures

The TTPs listed below are aligned to the MITRE ATT&CK Enterprise framework and represent techniques observed in incidents affecting the vertical during the reporting period.

5. Notable incidents and campaigns

6. Vulnerabilities of concern

The vulnerabilities below are those assessed to carry the greatest material risk to the vertical at the time of issue, taking into account exploit availability, observed exploitation, the prevalence of affected products in the sector, and listing on the CISA Known Exploited Vulnerabilities catalogue.

7. Indicators of compromise

Indicators are defanged in line with industry convention. Confidence ratings reflect the analyst's assessment of the strength of the association between the indicator and the named actor or campaign. IP Insights reputation feed currently lists 812,641 distinct IPv4 addresses across active blocklists (snapshot 04 May 2026 08:15 UTC). AS200651 (FlokiNET) currently lists 110 of 131 known IPs as blacklisted (risk score 100/critical); the AS continues to host bulletproof-style infrastructure observed in the reporting period across phishing, RAT C2, and brute-force activity.

A machine-readable companion file in STIX 2.1 format is available on request from the lead analyst.

8. Sector risk assessment

The risk assessment below combines the threat picture established in earlier sections with an estimate of the impact each scenario would carry for a representative organisation operating in the vertical.

9. Recommended defensive actions

The recommendations below are organised against the three operational pillars of Detect, Defend, and Disrupt. They should be prioritised according to the risk ratings assigned in Section 8 and the operational maturity of the receiving organisation.

Detect

Detection priorities are: identity-provider audit-log hunting for password-reset / MFA-enrolment-change events outside the customer-specific baseline (Scattered Spider tradecraft); cloud admin-plane hunting for new-app-registration / new-federation-domain events; rclone / Mega.io / direct-cloud-object-storage egress from corporate file-shares; PowerShell -ExecutionPolicy Bypass parented by non-baseline processes; and Citrix NetScaler / Cisco SD-WAN exploitation indicators as soon as Sigma rules are released. Where customers operate Magento / Shopify / similar e-commerce platforms, hunting for Magecart-pattern script injection in checkout-page resources is warranted.

Defend

Patching priorities are dominated by Citrix NetScaler ADC / Gateway and the Linux kernel CVE-2026-31431. The single highest-impact defensive investment for the vertical is identity-controls hardening to mitigate Scattered-Spider-style helpdesk social engineering: number-matching MFA, helpdesk procedure requiring out-of-band verification for password reset and MFA enrolment changes, and conditional-access rules requiring a known-device or known-network token for high-privilege accounts. ISO/IEC 27001 Annex A controls A.5.16 (identity management) and A.5.17 (authentication information) are direct levers. PCI-DSS v4.0 controls remain the operating standard for cardholder-data environments.

Disrupt

Disruption priorities are tabletop exercise against the helpdesk-compromise scenario for any customer with outsourced retail support; coordination with the Retail and Hospitality ISAC where customers are members; sustained sharing of the IP Insights blocklist into customer perimeter-block lists; and rehearsal of the customer-PII-extortion-without-encryption scenario for any customer holding material loyalty / membership data.

10. Forward outlook

It is highly likely that Scattered-Spider-style helpdesk social engineering will remain the principal helpdesk-and-identity material-risk scenario for the vertical over the next reporting cycle. (HIGH confidence; 30-day horizon)

It is likely that ransomware leak-site activity against UK retail will continue at sustained tempo, with DragonForce, Qilin and Akira the most operationally-relevant operators. (HIGH confidence; 30-day horizon)

It is likely that Citrix NetScaler exploitation will affect at least one UK retail edge appliance within the next two reporting cycles. (MEDIUM-HIGH confidence; 60-day horizon)

There is a realistic possibility that a UK retailer will suffer a Cl0p-pattern shared-SaaS data-extortion event within the next six reporting cycles. (MEDIUM confidence; 180-day horizon)

Trigger conditions that would prompt revision of this forecast: a confirmed Scattered-Spider intrusion into a UK retailer's identity provider; in-the-wild exploitation of a previously-quiet retail SaaS platform along the Cl0p pattern; observed Magecart-pattern script injection on a customer e-commerce checkout.

11. Analytic confidence and source reliability

Analytic confidence ratings used throughout this report express the analyst's assessment of the strength of the evidence and reasoning underlying each judgement. HIGH indicates well-corroborated evidence drawn from multiple credible sources and a strong analytic line of reasoning; MEDIUM indicates plausibility supported by partial corroboration or sound analytic inference; LOW indicates limited evidence, single-sourcing, or significant uncertainty in the underlying data. Where confidence is LOW, the rationale is recorded in the body of the report rather than allowed to stand unexamined.

Sources cited in Section 12 are graded against the Admiralty System, which assesses source reliability on a scale of A to F and information credibility on a scale of 1 to 6. The full key is reproduced below for reference.

12. References

The numbered references below correspond to citations within the body of the report. Each entry is graded against the Admiralty System.

---

About this report

UK Cyber Defence's SOC publishes sector threat intelligence for the organisations it defends, graded against the Admiralty system and mapped to MITRE ATT&CK. This public edition is provided in good faith on the basis of sources held to be reliable at the time of issue; recipients remain responsible for how they apply it. If you would like sector briefings, indicators and detection content for your own organisation, talk to an analyst or read about SOC365, our managed SOC.