Cyberattacks ‘wake-up call to retail’ says government security body chief

The National Cyber Security Centre’s CEO has said the spate of cyberattacks on supermarkets “should act as a wake-up call to all organisations”.

In a statement, NCSC CEO Dr Richard Horne said the government body was working with the businesses affected to “fully understand the nature of these attacks and to provide expert advice to the wider sector based on the threat picture”.

“I urge leaders to follow the advice on the NCSC website to ensure they have appropriate measures in place to help prevent attacks and respond and recover effectively,” he added.

The body said it had been working with M&S and Co-op following their attacks.

Cyberattacks on retailers

Late last week, M&S chief Stuart Machin issued a new apology to customers over a cyberattack which the retailer has been battling “day and night” for two weeks. Machin first informed customers of the attack on 22 April. It has forced the retailer to halt online clothing and home deliveries, stop processing Sparks loyalty app rewards, suspend online recruitment, and led to what it has called “pockets of limited availability in some stores” as it impacts depot computer systems.

Last month, Co-op shut down parts of its IT estate, having “recently experienced attempts to gain unauthorised access to some of our systems”.

On Friday the retailers issued a statement saying “as a result of ongoing forensic investigations, we now know that the hackers were able to access and extract data from one of our systems”.

“The accessed data included information relating to a significant number of our current and past members. This data includes Co-op Group members’ personal data such as names and contact details, and did not include members’ passwords, bank or credit card details, transactions or information relating to any members’ or customers’ products or services with The Co-op Group,” the company said.

Co-op CEO Shirine Khoury-Haq yesterday said she was “very sorry this happened” and that the incident was “obviously extremely distressing for our colleagues and members”.

The Information Commissioner’s Office (ICO) – the UK’s independent regulator for data protection and information rights law – has confirmed it too is working with M&S and Co-op.

Stephen Bonner, deputy commissioner at the ICO, advised the public to ensure “accounts are protected by a strong password and that you are not using the same password across multiple accounts” and for consumers to regularly check for updates from impacted retailers and follow their advice “if they confirm that your personal information has been impacted by a cyberattack”.