M&S takes systems offline as 'cyber incident' lingers

UK high street retailer Marks & Spencer says contactless payments are still down following its "cyber incident" and order delays are likely to continue. The clothing, homeware, and produce purveyor told customers in an update on Wednesday evening that Click & Collect orders were also suspended until further notice, and that …

[StewartWhite]

British Library - comms good, actions bad

Whilst their comms were indeed a good example, the actual restoration of systems was pitifully slow. Anecdotally (although there was plenty of material online to back this up - no pun intended), months after the issue I was talking to a British Library visitor on the train and they'd been told that day that they were still unable to access a book they wanted because the relevant systems still weren't available. Maybe an extreme example of where you can communicate or you can solve the problem but unless you have sufficient resources you can't do both simultaneously?

[Doctor Syntax]

Re: British Library - comms good, actions bad

The main resource needed for good communication is honesty. AFAICR the BL decided to bring forward a planned rebuild to be able to start with a known clean slate and not to pay any ransom..

[Decimal5446]

Re: British Library - comms good, actions bad

The problem with these incidents. Let's assume its ransomeware. No company is resourced up enough to deal with it rapidly if it hits a lot of assets. It's a work rate vs people problem.

[BBRush]

Re: British Library - comms good, actions bad

It could also be a question of how the organisaiton is perceived in the market and whether this could affect their position within it. Commercial entities may not want competitiors, investors or shareholders getting the unfettered/honest updates, whereas a public body may have more ability to be honest over and above the required disclosures.

Sharing IOCs and post incident reports, even redacted, to allow others in a market sector to protect themselves could be seen as nearly heresy in the commercial world.

[Doctor Syntax]

Re: British Library - comms good, actions bad

"could be seen as nearly heresy in the commercial world"

Until it bites them in the arse.

[Tron]

Re: British Library - comms good, actions bad

Some services that are vital for researchers (such as the ESTC) are still offline. Maybe it could have been put back together on dedicated silicon with its own website. Credit to Nikolai Vogler for getting an older version of the ESTC up and running as quickly as he did for researchers to use until the BL manage to get back in the saddle.

Trying to lump so many different services together is not a good idea. Some systems are much easier to secure when standalone. Cobbling them with more complex/interactive services makes everything as vulnerable as the weakest link.

[A Non e-mouse]

As for why contactless payments are down, with no mention of chip and PIN payments being affected, M&S hasn't responded to our questions

As a consumer, it seems Chip & Pin, Contactless and Apple/Google Pay are all separate payment authorisation systems.

[Anonymous Coward]

Contactless was working ok in stores this morning, but we were advised not to use our Sparks loyalty card because it would be very slow to get a response.

[MrBanana]

Ground floor: Perfumery, Stationery and Leather Goods, Wigs and Haberdashery. Going up...

"The clothing, homeware, and produce purveyor..."

I think you meant knickers & bras, scented candles, and Prosecco ...

I only buy one of the above from M&S.

[Doctor Syntax]

Re: Ground floor: Perfumery, Stationery and Leather Goods, Wigs and Haberdashery. Going up...

The only one reasonably near to me is just another out of town grocery store and as there are a good many alternatives considerably closer I don't buy anything there at all. Did diversifying away from their core business really do them any good in the long run?

[katrinab]

Re: Ground floor: Perfumery, Stationery and Leather Goods, Wigs and Haberdashery. Going up...

I see them as a reasonably decent food shop with a rubbish clothing department attached to them.

I'm not exactly the world's youngest person, but even I think the clothes look way to "old".

[Anonymous Coward]

NMRN

Interesting to see discussion of British Library, also of concern are National Museum of the Royal Navy - ticketing system seems to have recovered since Dec 24, but no news about other systems - https://www.nmrn.org.uk/news/national-museum-royal-navy-statement refers. I believe they have electronic archives that includes videos and scans of historical photographs as well as an index of items in their archive. They need to be doing better comms - I'm concerned that they might be having conversations like this https://youtu.be/K_FrQnQv0Vw?si=r0nFLydpy9Qwradx

Presumably the archive could be reconstructed for a price, my biggest concern is for assets that only exist in digital form