M&S ‘cyber Incident’

[user1471427667]

Hi,
not sure what is going with M&S. Firstly, last week they were wrongly advertising 15% off everything but when you got to checkout it didn’t go through and just called it a ‘glitch’. Then, I went into store on Monday and while queuing at checkout I heard the cashier explain that all their tills were offline and they were unable to honour any sparks online offers. As I had a 20% off voucher for some trousers, I decided to wait and order them online instead, thinking it was just a problem with my local store.
I placed an order online on Wednesday for 3 items, my money was debited from my card as usual and I was sent an email with order details saying my items would be ready to collect in storeon Saturday - all good.
As I’m checking my order this morning, I see the items haven’t even been despatched yet. Then this afternoon, I see the following message on the website ( I was unaware of this and wonder why, if they knew this on Tuesday, did they take my money for my order on Wednesday?)
I also realise, I cancelled another order last week and I’ve yet to receive a refund ( usually get them within 48hrs)

From memory, order was between £50-100. Gift card is £10. It’s a nice gesture, plus has prompted me to buy. Saw a bra in store which they didn’t have in my size in the colour I wanted. They have it online but slightly resented paying the £3.99 delivery fee so was going to leave it/look elsewhere. But this gift card more than pays for delivery so I’m ordering it

I’ve had £5 & my order was for over £200, however my order was only delayed by a day, so not really impacted by it at all, so wasn’t expecting to get anything!

I got a £10 gift voucher which came in very handy as I needed to buy a present. My cancelled order was for £40 for cupcakes and I cancelled it myself as there was so much uncertainty at the time.

I actually held off on ordering bra as thought click and collect may come back ( it says ‘in next few weeks’) . Then, this morning (Thursday) my sparks card had several offers on it including free delivery on clothes and homeware (saving £3.99) and 20% off lingerie! Together with my gift card I got the bra for a couple of quid! So nice to get offers again. Free delivery in particular is a really good shout

My order which was cancelled during that time was around £120 and I got a £10 voucher.

I was hoping to put an order in for knickers for DD (potty training time for us!) and was hoping to get it delivered in store but noticed there are no options for in store delivery... Just £3.99 for home delivery. I cant remember if m&s home delivery cost that much, or maybe I've always ordered over the amount that qualifies for free delivery. I'm going to go in store for the knickers I think

Breaking story on Sky that a woman and 3 teenagers have been arrested in connection with this and the co op attack and Harrods’ ( hadn’t heard about the Harrods’ one)

Two British teenagers are arrested over cyber attacks that have crippled M&S, Co-op and Harrods | Daily Mail Online

If it was them I hope there can be some form of punishment that matches the huge costs and stress they've put everyone through

Wow, they are all SO young! I mean, I would have guessed youngish but the oldest is only 20 and the youngest not even an adult.
I wonder if a ransom was paid and that’s how they were caught ?

My understanding is that the whole mess was due to M and S refusing to pay a ransom, I doubt that's how they've been found

The early reports that the hackers were teenagers do now appear to be true

Companies never pay the ransom in cyber attacks because you can’t trust criminals not to release customer data and other secrets.

Yes, I'd read that it's all gone on so long because, as M&S didn't pay the ransom, they've been locked out of their own systems the whole time and have had to rebuild them from scratch. Which is longer and more painful but means the scammers can't get a second chance to do you over.

Plus if you agree then the people setting the ransom will think that the company will pay more and change the goalposts.
If they paid for the return of the M&S websites and databases then they’d still have to check that the hackers didn’t add any code that allowed them back in. It’s not just the website that they hacked. The hackers had employee timesheets, the systems that ensure the fridges are cold etc Safer to start from scratch.

I have heard that large companies often pay huge ransoms and then the hack is sorted quickly and never gets into the News. I don’t know if it’s the case though.

That's not true. M&S could have paid the ransom and as has been said above there is no guarantee they would have them got back into their systems. If they did there is no guarantee the hackers hadn't left code in there or still had access. They did the best thing which is to re build and be able to ensure the hackers don't have access anymore. I am so surprised that people think this M&S should have paid the hackers and everything would have been resolved quickly, so naive.
These are not nice people. It is known that scattered spider are mainly young people doing the hacking. But it's a huge criminal gang, not the kind of people you want to be paying a ransom to and trusting their word.

What I Meant was, I wonder if police advised them to communicate with hackers to agree to pay them, then be able to track where the payment went iyswim? Like they do with kidnappers who send ransoms .

M&S is a listed PLC. Their results announcement and Annual Report after the end of their financial year should shed more light on what happened and whether they paid anything. I suspect they didn't hence the magnitude of the losses and length of time to rectify things.

I wasn’t suggesting M&S should have paid a ransom. I don’t think that at all. I was just saying that I’d heard that large companies often do that.

@StrikeForever apologies I somehow quoted the wrong post. I meant to quote @B1indEye who said the whole mess was caused by M&S not paying the ransom