The Attack That Started With a Phone Call
Easter weekend 2025. Marks & Spencer — 141 years old, 65,000 employees, £13 billion in annual revenue, and one of the most recognisable brands in British retail — began experiencing system failures across its digital infrastructure. Online orders stopped processing. Contactless payment terminals in stores went dark. The click-and-collect service, which M&S had invested years building into a competitive differentiator, was suspended entirely.
The technical payload responsible was DragonForce ransomware, deployed by operators working within the Scattered Spider affiliate ecosystem — the same threat actor cluster that had cost MGM Resorts over $100 million in September 2023. But the entry point was not a software vulnerability. It was not a zero-day exploit against M&S's infrastructure. It was a telephone call to the IT help desk in which an attacker, impersonating a legitimate M&S employee, persuaded a support agent to perform a credential reset that bypassed multi-factor authentication.
This is Scattered Spider's signature move, refined across dozens of enterprise targets since 2022. The group — predominantly English-speaking, with members believed to be based in the US and UK — are expert social engineers who conduct detailed reconnaissance on corporate directory structures, org charts, and IT support procedures before making contact. They know the right terminology. They know the internal systems by name. They know how to manufacture urgency convincing enough to cause a help desk agent to override security protocols they were explicitly trained to enforce.
The Technical Execution: From Help Desk to Domain Controller
Once Scattered Spider operators had socially engineered valid credentials for an M&S account, the subsequent attack chain followed a documented pattern consistent with prior Scattered Spider operations. Initial access via the reset credential provided a foothold in M&S's internal environment. From there, operators conducted reconnaissance to identify high-value targets: Active Directory infrastructure, domain controllers, and the Windows domain administrator accounts that would give them the lateral reach to deploy ransomware at scale.
Scattered Spider affiliates are documented users of NTLM hash extraction techniques — capturing credential hashes from compromised systems and using pass-the-hash or offline cracking to elevate privileges without needing plaintext passwords. Combined with tools available in post-exploitation frameworks, this approach allows the group to move from an initial low-privilege endpoint compromise to domain administrator access in hours, not days, in environments that lack modern endpoint detection and privileged access management controls.
The ransomware payload — DragonForce — was deployed after the operators had established sufficient domain control to encrypt systems at a scale that would produce maximum operational disruption. The Easter weekend timing was not accidental. Reduced IT staffing, higher retail transaction volumes due to the holiday period, and lower monitoring attention during a bank holiday created the conditions that ransomware operators explicitly plan around. The technical attack was sophisticated. The strategic timing was strategic intelligence, not luck.
Three Weeks Offline: What £300 Million in Retail Disruption Looks Like
M&S's online operation — which generates a significant and growing proportion of its clothing, home, and food revenues — was effectively taken offline for approximately three weeks following the Easter 2025 attack. During this period, the company's website remained accessible but the ability to place, process, and fulfil online orders was suspended. For a retailer that had invested substantially in digital transformation and positioned its online channel as a growth engine, the disruption was not merely operational. It was strategically damaging.
In-store, the failure of contactless payment infrastructure created significant friction at the point of sale. In a retail environment where the majority of transactions are now conducted contactlessly, reverting to chip-and-PIN and cash processing created queue times that deterred purchases and frustrated customers accustomed to frictionless checkout experiences. M&S stores did not close, but their operational efficiency was materially degraded during a period — the weeks following Easter — that is historically important for clothing and seasonal product sales.
Analysts estimated the total financial impact at £300 million or more when accounting for lost online sales, in-store revenue disruption, emergency IT expenditure, customer communication costs, and the reputational impact on a brand that had been explicitly investing in digital trust. For context: £300 million represents approximately 2.3% of M&S's annual revenue — a significant figure for a single incident with a root cause that a structured identity verification protocol could have prevented.
Why Help Desk Social Engineering Is the Most Underdefended Attack Surface in Enterprise Security
The M&S incident belongs to a rapidly growing attack category that most enterprise security programs are structurally ill-equipped to defend against: vishing-based identity verification bypass at IT service desk operations. Security budgets are allocated overwhelmingly toward technical controls — firewalls, EDR platforms, SIEM deployments, penetration testing engagements. Very little of that investment reaches the person answering the IT support phone who is being asked to reset a credential for someone claiming to be the Head of Merchandising who is locked out ahead of a board presentation.
Scattered Spider's success rate against enterprise targets — MGM Resorts, Caesars Entertainment, M&S, and a documented list of others — demonstrates that this attack vector works reliably against organisations that have not implemented caller identity verification protocols that are independent of the information the caller themselves provides. An attacker who has conducted LinkedIn reconnaissance on an organisation knows the employee's name, department, manager's name, and recent internal projects. This information is not a secret. It is public. Using it to verify caller identity is equivalent to using a password that an attacker has already read.
The technical solution is not complicated. It is a procedural and cultural problem. Identity verification at the help desk must be based on something the caller cannot have obtained through public reconnaissance — a hardware token OTP, a biometric-backed authenticator app verification initiated by the employee on a registered device, or a callback to a pre-registered number. The procedure must be non-bypassable regardless of urgency narrative. Managers calling on behalf of employees should not be able to override the protocol. The help desk agent must be empowered — and specifically trained — to refuse requests that do not complete the verification sequence, without fear of escalation or complaint.
The Scattered Spider Pattern: Why the Same Playbook Keeps Working
Scattered Spider is not a traditional ransomware group. They are a financially motivated, English-speaking threat actor cluster with documented expertise in social engineering, SIM swapping, and corporate identity impersonation. They do not write malware — they leverage established ransomware-as-a-service platforms (BlackCat/ALPHV, DragonForce) for the encryption payload. Their core competency is initial access via human manipulation, not technical exploitation.
This specialisation makes them particularly dangerous for several reasons. Their attacks do not trigger signature-based detection because the initial access is a legitimate credential authentication, not a malware execution. Their social engineering scripts are refined through repeated use across dozens of enterprise targets. They are adaptive — when one help desk verification method is defeated, they iterate to the next available bypass. And they operate in English, which removes the language-based detection heuristics that sometimes flag nation-state actors operating in other languages.
The fact that the same fundamental playbook that compromised MGM Resorts in September 2023 was still successfully operational against a major UK retailer eighteen months later in April 2025 is not a coincidence. It is evidence that the enterprise security community has not yet operationalised the procedural controls needed to close this attack surface. The gap is not technical capability. It is organisational will to enforce identity verification procedures that create friction for attackers at the cost of a minor inconvenience for legitimate users.