Retail on ransomware red alert

Surge in malware attacks on businesses leaves UK retailers reeling

- 

Marks & Spencer's online orders have been “paused” for almost a month; Co-op has admitted the loss of customer data and other operational difficulties; even Harrods was battening down the hatches to fend off a cyberattack. It has been a fraught month for British retailers.

All three are believed to be victims of the ransomware group DragonForce, which runs its own affiliate scheme for freelance hackers in much the same way that Amazon pays commission for driving sales to its site.

It's fuelling a 22% year-on-year increase in ransomware attacks on the consumer goods and services sector, according to the security company Check Point, while the National Cyber Security Centre (NCSC) has offered stark warnings for other retailers to check their systems and be on high alert.

If you're working in the IT department of a retailer this summer, be prepared to cancel all leave.

How did the hackers get so deep into the retailers' systems? It wasn't through lax gateway security so much as old-fashioned human failings. IT support desks were conned into resetting the credentials of employees, some of which appeared to have admin-level privileges on the network.

Check Point's head of public sector, Graeme Stewart, says AI has made it easier than ever to break into corporate systems. “If you take these DragonForce guys, they're now using AI large language models to develop malware and to do audio-visual impersonations and deepfakes to break in and make these calls to help desks,” he said.