SOC status:Duty analyst on shift
Sectors · Retail
Store estates, e-commerce platforms, hospitality and leisure. After the 2025 attacks on UK retail, boards understand the risk; we turn that into monitoring, testing and a service desk that cannot be talked into a password reset.
PCI DSS 4.0UK GDPRPeak-season readinessStore and online
The Scattered Spider and DragonForce campaign against Marks & Spencer, the Co-op and Harrods in 2025 set the template: a phone call to an outsourced helpdesk, an MFA reset, a pivot into the identity provider, then ransomware across the estate at the worst possible moment. That playbook has been copied by adjacent groups and now baselines the UK criminal ecosystem. Alongside it sit payment-page skimming on Magento and Adobe Commerce storefronts, credential stuffing against loyalty and account portals, DDoS in peak trading windows and the edge-appliance vulnerabilities that give ransomware crews their first foothold. Our weekly retail report tracks all of it and puts the defensive actions in priority order.
What we watch for
Callers who know enough to pass as staff and obtain an MFA reset from an outsourced service desk.
From one reset to Okta or Entra ID administration, then to the whole estate.
Magecart-family injection into checkout pages through platform and plugin vulnerabilities.
Credential stuffing against loyalty and customer accounts, feeding fraud and refund abuse.
Disruption timed to Black Friday, Christmas and the January sales.
ESXi-aware encryption of the virtualised estate behind stores, warehouses and online.
How we help
Weekly report
Retail remains in a social-engineering-driven era: the Scattered Spider help-desk doctrine, long-running Magecart skimming against major-card payment flows, and the SonicWall SMA1000 zero-day chain dominate the week.
The retail vertical continues to be shaped by the M&S / Co-op / Harrods retrospective — reclassified by UK observers as a "Category 2 cyber hurricane" with total combined costs assessed at £270m–£440m — and by the continued arrests connected to the DragonForce / Scattered Spider cluster.
The retail vertical remains defined operationally by the DragonForce / Scattered Spider methodology - voice-phishing IT service desks to reset MFA, help-desk social engineering, aggressive cloud-tenant pivot, and DragonForce ransomware detonation.
Coverage this period is dominated by the NCA arrests on 30 Jun 2026 of four UK nationals connected to the M&S / Co-op / Harrods DragonForce / Scattered Spider cluster, the CISA KEV addition of CVE-2026-45659 (SharePoint deserialisation RCE)…
The dominant theme this period is the continuing operational dominance of the DragonForce / Scattered Spider cluster against UK retail - its 2025 M&S…
During the reporting period the principal observations were the continued Scattered Spider / DragonForce cluster's UK-retail targeting (anniversary of the 2025 M&S, Co-op, Harrods campaign now approaching its first cycle); the persistent Magento / Adobe Commerce skimmer wave that Sansec…
Questions
Yes — this is the most common gap we find. We write the caller-verification procedure, test it with a real pretext call, and monitor for the identity changes that follow a successful one.
Yes. Platform, WAF and CDN logs join the rest of the telemetry, and skimming, credential-stuffing and checkout-tampering patterns have their own detections.
We run a peak-readiness review in the autumn — patch state, DDoS posture, change freeze, escalation paths — so that November is boring.
Start a conversation
Thirty minutes on your estate, your service desk and your storefront before the season starts.