M&S Cyber Attack Chaos Leaves More Questions Than Answers

Marks & Spencer hit by DragonForce ransomware, halting sales and deliveries. Experts warn M&S customers to update passwords.

By Content Team

Feb 18, 2026

ON THIS PAGE

Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our privacy policy.

Marks and Spencer has been reeling from a major cyber attack for over a week, costing millions in lost sales and hitting its share price. Security experts tell the BBC that ransomware called DragonForce was used, with fingers pointing at the Scattered Spider hacking group - some reportedly teenagers - who previously hit MGM Las Vegas.

The attack knocked out online ordering, paused deliveries, and left store shelves empty. M&S paused online orders Friday and won't say what happened or who's responsible. Cybersecurity experts say this looks like ransomware - malware that locks systems until criminals are paid a ransom.

Recovery is complex and slow for major retailers dependent on interconnected systems for everything from inventory to payments. Experts advise M&S customers to change passwords on other sites if they reused their M&S credentials.

Source: BBC

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo