BBC Journalist Confirms M&S and Co-op Data Breaches After Contact with Hackers

BBC cyber correspondent Joe Tidy recounts how anonymous hackers contacted him via Telegram, claiming responsibility for recent cyber attacks on UK retailers M&S and Co-op. The attackers provided samples of stolen data to support their claims, prompting the BBC to verify and report the breach in the public interest. The hackers were frustrated that Co-op had not paid a ransom and later sent a hostile message criticizing the company’s response. The group behind the attack is linked to DragonForce, a cybercrime service operating on the dark web that offers ransomware-as-a-service. DragonForce, which recently rebranded as a cartel with extensive tools and support for hackers, is competing in an evolving cybercriminal landscape. Although DragonForce has remained silent on the M&S and Co-op incidents, experts speculate this could mean the victims paid to suppress disclosure. There are also indications that the attacks may have been orchestrated by Scattered Spider, a loosely organized group of young, English-speaking hackers in the UK and US. Despite recent arrests, the group appears undeterred. The hackers declined to confirm affiliation with Scattered Spider but referenced characters from ‘The Blacklist’, saying they were targeting UK retailers.