UK Update: M&S Ransomware Attack – What Can We Learn?

The recent ransomware attacks on M&S and other British retailers serve as a reminder – as if we needed one – of the ubiquitous nature of cyber crime, and the widespread disruption which it can cause to both businesses and individuals.
The BBC has reported that M&S began experiencing problems over the Easter weekend (the risk of cyber attack increases during public holidays) and that some of its operations, including online food ordering, remain offline some two weeks later.

The UK’s data regulator, the Information Commissioner’s Office, has confirmed that it is “making enquiries” with M&S, as well as the Co-op Group, which was also subject to recent attack. The ICO will be looking to establish whether the security measures employed by M&S and the Co-op were appropriate, or whether they contributed to the success of the attacks. If either entity is held to have breached its obligations under the UK GDPR, formal enforcement action may follow.

Following these incidents, the National Cyber Security Centre has published further recommendations for businesses on the steps they can take to improve their security position.

In addition to the impact on the companies targeted by the attack, individuals may also be affected where their personal data was exfiltrated by the attackers. As well as the loss of privacy, this can expose individuals to increased risk of identity theft or fraud.

These recent incidents reflect a number of the key themes and issues which we cover in our regular cyber blogs, which are available here:

• Cyber security – fin(e)al decisions from the ICO
• Cyber Crime in the Trust Economy: Navigating an evolving threat landscape
• Is a ban on payments to hackers the answer to the growing threat of ransomware?
• Cyber security – Looking back on 2024 and what businesses can expect in 2025
• Cyber risk in the energy sector
• Cyber risk in the charity sector
• Navigating cyber resilience: Key insights from our cyber conference
• Increasing cyber risks to UK local authorities
• Boeing hacked by LockBit: Ransomware and the effect on supply chain

Our team are on hand to support you on your cyber resilience journey, from implementing protective measures to handling a full-scale incident. Please get in touch with any of our team to discuss your needs.

By Burness Paull LLP, Scotland, a Transatlantic Law International Affiliated Firm.  

For further information or for any assistance please contact ukscotland@transatlanticlaw.com

Disclaimer: Transatlantic Law International Limited is a UK registered limited liability company providing international business and legal solutions through its own resources and the expertise of over 105 affiliated independent law firms in over 95 countries worldwide. This article is for background information only and provided in the context of the applicable law when published and does not constitute legal advice and cannot be relied on as such for any matter. Legal advice may be provided subject to the retention of Transatlantic Law International Limited’s services and its governing terms and conditions of service. Transatlantic Law International Limited, based at 84 Brook Street, London W1K 5EH, United Kingdom, is registered with Companies House, Reg Nr. 361484, with its registered address at 83 Cambridge Street, London SW1V 4PS, United Kingdom.