Marks & Spencer admits cybercrooks made off with customer info

Marks & Spencer has confirmed that customer data was stolen as part of its cyberattack, fueling conjecture that ransomware was involved. The retail giant's operations were hit hard, it had to pull systems and services offline, and now data has been exfiltrated – all of which are common hallmarks of a ransomware attack. Yet M&S …

[Anonymous Coward]

as a regular customer ...

I don't really give a fuck that they got hacked (I mean, its not ideal, but it happens, especially to organisations such as this).

The thing that I do give a fuck about is them not practicing the art of full disclosure and telling us what happened, in full.

Still relatively early days, so maybe when they're fully recovered they will.... (I won't hold my breath. Thus far, they've looked very reluctant to disclose information).

[Mentat74]

Re: I don't really give a fuck that they got hacked...

Well... I do...

If a company holds my personal data then they are responsible for it's safety !

And they should be held accountable for any negative consequences of a data breach...

[Lee D]

Re: I don't really give a fuck that they got hacked...

My biggest question is why does M&S hold your date of birth?

[heyrick]

Re: I don't really give a fuck that they got hacked...

It's quite common for retailers to ask that - in return they offer special crap on your birthday...

[Woodnag]

Re: I don't really give a fuck that they got hacked...

To go with the "household information" that they retain.

[JWLong]

Re: I don't really give a fuck that they got hacked...

Fine, I was born on the 2nd of August.

They don't need the year.

[MachDiamond]

Re: I don't really give a fuck that they got hacked...

"My biggest question is why does M&S hold your date of birth?"

Because they can. They asked, you provided and it's worth money. If you didn't give it to them directly, they may have "partnered" with instapintatwitface.com where you have an account and failed to read the ToS/Privacy Policy properly.

[tiggity]

Re: I don't really give a fuck that they got hacked...

Only places that have my real DOB are those that actually need it e.g. banks, NHS (UK health system), driving licence & passport authorities

Everything else gets a dummy DOB value - only something that has a legitimate need for my DOB gets the proper one as DOB is classic identity theft item (never understand habit of people announcing actual birthday to all & sundry on social media either)

[Screwed]

Re: I don't really give a fuck that they got hacked...

Because they kept asking me to supply my DoB, In March I actually asked them why.

Good day Screwed,

Thank you for getting in touch regarding your M&S online profile. I am so sorry that the website or app keeps asking you to verify your date of birth. I understand your frustration, as I too would’ve been if I were in your situation.

Screwed, the reason we keep asking is because M&S is now giving free birthday treats, and because you have not added yours, we will not know when you should be getting a birthday treat from us.

Not to worry, we understand if you do not want to add this. We unfortunately cannot remove this question at all, so I would like to kindly ask you to ignore this the next time you log in.

Thank you for your loyalty, we at M&S really appreciate it.

Kind regards

One of the problems is that while I can obviously reply with any date, I might cause some odd problem down the line. For example, some cross-checking of my account against other data (credit reference agencies?). And I would feel silly if I caused my own problems.

We should be able to safely supply any date for M&S to use as our "official" birthday. If it is solely to offer a tin of biscuits, then it would have no consequences if I choose the date that works best for me.

[tip pc]

Re: I don't really give a fuck that they got hacked...

Good day Screwed,

Thank you for getting in touch regarding your M&S online profile. I am so sorry that the website or app keeps asking you to verify your date of birth. I understand your frustration, as I too would’ve been if I were in your situation.

Screwed, the reason we keep asking is because M&S is now giving free birthday treats, and because you have not added yours, we will not know when you should be getting a birthday treat from us.

Not to worry, we understand if you do not want to add this. We unfortunately cannot remove this question at all, so I would like to kindly ask you to ignore this the next time you log in.

Thank you for your loyalty, we at M&S really appreciate it.

Kind regards

my "something not right" dar was off the charts reading that,

i even substituted my name with "screwed' & re read it & it still sounded not like a company responding.

Too helpful, too willing to sympathise with the issue etc etc.

just seems iffy

[collinsl]

Re: I don't really give a fuck that they got hacked...

Looks AI generated to me.

[MachDiamond]

Re: I don't really give a fuck that they got hacked...

"Too helpful, too willing to sympathise with the issue etc etc."

Not understanding the concern you have is more like it. They'll keep asking in the same way as a significant other might keep asking about something in different ways to trick you into a confession when your guard is down.

I've made it my policy to not sign up for retailer online faff. If I can't check out as "guest', forget about it. If never some across there being something I really need not being available from several other sources when I can't find it in a local shop. I've never see a fair trade between surrendering my personal information for some paltry discount or 'gift'. They are businesses, so I expect it will never be close.

[wolfetone]

Re: I don't really give a fuck that they got hacked...

Has your data fundamentally changed since the Equifax hack?

Remember - you didn't need to be an Equifax customer to have been affected. You only had to have been dealing with a 3rd party who used them for a credit check.

We're all fucked. This M&S hack is the one you hear about, I'm certain there are others that haven't been revealed.

[Missing Semicolon]

Re: I don't really give a fuck that they got hacked...

Naah. 12 months fraud monitoring if you are lucky. No liability otherwise.

[Roland6]

Re: as a regular customer ...

From the issues they are having with stock control and distribution, I suspect M&S are still struggling to get back in to their systems and thus still don't actually know the extent to which they have been compromised...

Whilst people are focusing on the customer data, what is clear M&S are struggling with inadequate business continuity plans and a sudden discovery of just how much expertise and sector knowledge has gone. With weird non-sensical deliveries being made to stores because staff no longer have any real understanding of what stores are selling and what is a store's normal level of business and stock turnover.

Suspect the Co-op is hitting exactly the same stock delivery problems...

[Dave@Home]

Re: as a regular customer ...

There are a lot of staff posting on reddit with stories, including inability to see rotas and booked holidays as well

Stores seem to be getting pallets of big sellers and a lot of smaller throughput items are missed off

[brainwrong]

Re: as a regular customer ...

"no longer have any real understanding of what stores are selling"

Some retail businesses appear to have no real idea what they're selling anyway, or know how to manage their stock.

I've seen one convenience store retailer would re-order stock to replace sold items, but the stock control system didn't record the price the item was sold at, only that a sale occurred. They also had a policy that items close to their sell-by or best-before dates would be reduced however much necessary for them to sell, they weren't to bin any items. One store got themselves into the situation where they kept getting deliveries of an item that nobody wanted, it all had to be reduced to below cost price to sell, losing them money. More such items were then ordered and delivered to store. They were unable to stop this.

If you look in your local supermarket, you will often see with short life products that a new delivery will be put straight out on the shelves behind older stock without waiting for the older stock to sell. Shoppers then rummage through and take the newer items, leaving the older items on the shelf to get older. They should wait for the old stock to sell first (it usually still has a good life at this point) and then put out the new stock, that way you're less likely to find the only items on display have 1 day life.

[Primus Secundus Tertius]

Re: as a regular customer ...

I am one of those customers who rummage at the back for new stock. I refuse to buy end-of-life items, I will find something else instead. So put the new stuff up when you get it, please.

[brainwrong]

Re: as a regular customer ...

The point is that the stock should not get to be end of life in the first place.

[MachDiamond]

Re: as a regular customer ...

"The point is that the stock should not get to be end of life in the first place."

A lot of things will be stocked deep for holidays. After Passover, there's loads of stuff that's blown out. Same for Easter, Christmas, Halloween, etc. Anything edible probably won't be good the next year and will not be the worth the cost to store it. If stores need to, they'll bin stuff and write the cost down for taxes. Food is problematic so selling things at 1/2 cost can be less of an issue than binning it.

[MachDiamond]

Re: as a regular customer ...

"They also had a policy that items close to their sell-by or best-before dates would be reduced however much necessary for them to sell, they weren't to bin any items. "

I see those "manager special" items marked way down. There's some packs of pepperoni in the freezer I got at deep discount. It's stored refrigerated in the store, but freezes just fine and can be put on something getting shoved in the oven without needing to be thawed. It cooks up with no problems. I always look over the discount rack in the corner and often find good deals. I can murder a 4-pack of cherry turnovers being sold at 75% off before they're inedible.

[logicalextreme]

Re: as a regular customer ...

I've only ever seen perishables reduced to a decent price and by a decent percentage (considering they can't be sold after the store shuts that day) in the Co-ops near me. Admittedly the percentage thing is down to the fact that they've become a decent price from the full Co-op price, but it bloody works — marked down around 1500, reduced shelves empty by closing.

(That said, sometimes Co-op's "reduced to clear" prices strongly imply that they understand neither the concept "reduced" nor "to clear").

Near me there are also some Tescos (the crappy overpriced convenience ones), a Morrisons, an M&S and an Aldi. Their reductíons are so slim as to be practically nonexistent and seem to be a waste of yellow stickers as well as the stock they're presumably lobbing into the skip every night. Morrisons is by far the most egregious; you can count on a full fridge unit absolutely overflowing with meat, dairy, ready meals, snacks, fruit and veg right before closing every single night. Reductions are usually a few pennies at best. I hope the staff get to take it when they close.

[MachDiamond]

Re: as a regular customer ...

"(That said, sometimes Co-op's "reduced to clear" prices strongly imply that they understand neither the concept "reduced" nor "to clear")."

I was at the grocery a little while ago and checked the day old baked goods rack and the "deals" were no deal. Normally my rule is I am not allowed to buy cookies. If I want them, I have to make them from scratch, but I thought that since the package wasn't big, maybe I'd treat myself. When I looked at the reduced price, it was a few times my cost to make better cookies and the list price was way out in the Kuiper belt. If I have the time tonight, I'm going to try out the cookie press I bought some time ago.

[tip pc]

MSM: The hackers are believed to have tricked IT helpdesk workers into resetting staff passwords

From the telegraph

https://www.telegraph.co.uk/business/2025/05/13/ms-customer-data-stolen-in-cyber-attack/#:~:text=The%20hackers%20are%20believed%20to%20have%20tricked%20IT%20helpdesk%20workers%20into%20resetting%20staff%20passwords%2C%20giving%20them%20access%20to%20internal%20systems.%20Once%20inside%2C%20they%20have%20attempted%20to%20steal%20data%20and%20encrypt%20the%20retailers’%20IT%20network%2C%20demanding%20payment%20to%20unlock%20them.

The hackers are believed to have tricked IT helpdesk workers into resetting staff passwords, giving them access to internal systems. Once inside, they have attempted to steal data and encrypt the retailers’ IT network, demanding payment to unlock them.

[Anonymous Coward]

Re: MSM: The hackers are believed to have tricked IT helpdesk workers into resetting staff passwords

The worst thing about this.. a password/user combination alone shouldn't give you access to shit. We live in the age of FIDO, device compliance, device certificates, non-phishable MFA, so-on and so-forth.

WTF is going on when a major supermarket isn't practicing basic security principles?

[Roland6]

Re: MSM: The hackers are believed to have tricked IT helpdesk workers into resetting staff passwords

It was only a year ago that AWS mandated SFA for AWS root/admin accounts. 365 still allows username/password access to admin accounts…

[Anonymous Coward]

Re: MSM: The hackers are believed to have tricked IT helpdesk workers into resetting staff passwords

"Multifactor authentication for admins accessing Microsoft Admin Portals" was pushed as a conditional access policy by Microsoft in December.

[tip pc]

Re: MSM: The hackers are believed to have tricked IT helpdesk workers into resetting staff passwords

if its correct that the miscreants gained access via passwords etc then did they detect software installs and that necessitated rebuilds which has resulted in the huge delay in restoration of service?

also did they detect changed data?

so far we know that data has been exfiltrated which in todays world could just be copying cloud data to additional buckets.

perhaps data was also encrypted and the miscreants have the key & restoring from known good backups and recreating any changes is more challenging than some would imagine.

kind of makes me wonder what the point of expensive backups is when it can't be readily used in an emergency like this.

[JWLong]

Re: MSM: The hackers are believed to have tricked IT helpdesk workers into resetting staff passwords

>WTF is going on when a major supermarket isn't practicing basic security principles?

Boosting their stock price!

[Roger Greenwood]

I wonder ...

... which date of birth they have for me?

[MachDiamond]

Re: I wonder ...

"... which date of birth they have for me?"

Probably the correct one unless you've been lying for long enough.

I knew somebody that was a FB addict and told him that it is a giant data leak. He didn't believe me. He used a fictitious name with everybody and challenged me to find his legal name. Took me less than an hour and wasn't that hard. For giggles, I included his wife's legal name, and a bunch of other information like when and in what manner they were married. It's fine if he doesn't want everybody knowing his name, but that it is impossible to have a perfect disguise without staying off-line as much as possible and keeping documents out of view and locked up. Maybe not even then.

I don't advocate giving up and having a QR code tattooed on your forehead, but to be realistic about privacy and also be diligent.

[Roger Greenwood]

Re: I wonder ...

Could be, I genuinely can't remember. For well over 25 years now, when anyone asks for DOB (especially online) I ask myself how could they check? If I don't think they can then I fake it, usually 1/1/70 but several others. So far not been challenged, and it's nice to get all those birthday wishes several times a year.

[Missing Semicolon]

Re: I wonder ...

01/01/70, the nerd's birthday!

[JWLong]

Re: I wonder ...

I just use 01/01/01.

Let them figure it out.

[Michael Hoffmann]

Well...

... I'm sure that got their knickers in a twist!

[MachDiamond]

Re: Well...

"I'm sure that got their knickers in a twist!"

Twisted knickers? Aisle 6 under the rainbow banner.

[Steve K]

This is not just a breach, it's an M&S breach...

This is not just a breach, it's an M&S breach...

[hittitezombie]

Re: This is not just a breach, it's an M&S breach...

As for Harrods, if you ask about it, you cannot afford it.

[elsergiovolador]

More

We just need more cheap vibe AI staff.

There will be so many breaches, nobody is going to care anymore.

Imagine if all services you use, had complete data breach tomorrow.

[abend0c4]

We have shared information on how to stay safe online

Perhaps they should have read it themselves.

These types of incident are becoming increasingly inevitable and of course it's in our own interests to mitigate the potential fallout as far as possible, but it's not a good look to be pushing this message out to your customers after an event over which they have no control and in lieu of any meaningful explanation. Though I suppose arse-covering is M&S's fundamental business.

[Ken Moorhouse]

Re: arse-covering is M&S's fundamental business.

Give that commentard one of these - - >

[NewModelArmy]

Checkout As Guest Option Must Be Mandatory

At this stage, with so many hacks going on, it would be good for the law to be updated requiring that EVERY online service for purchasing allows for a checkout as Guest, with no details stored apart from processing the initial purchase.

[jwatkins]

Re: Checkout As Guest Option Must Be Mandatory

Even guest checkout still needs your name, address, etc.

[logicalextreme]

Re: Checkout As Guest Option Must Be Mandatory

Retailers should really be getting rid of or at least anonymising that information after there's no reason for them to hold it anymore, though it can be easy to argue the toss on that in various ways and I can count the number of times I've seen it happen on one finger (and that was only to reclaim disk space).

A couple of mitigations for the more privacy-minded might be to get things delivered to one of those bajillion locked thingies or dropoff points and use a payment processor that you have an account with, though the only one I've used is PayPal and they seem to fling your name and address at anyone you buy from regardless of whether either are necessary for the transaction in question.

[SAdams]

Re: Checkout As Guest Option Must Be Mandatory

Why does it matter if people have your name and address? I think anyone whose security is based on their name and address not being public information is starting from a really bad place.

[af108]

Re: Checkout As Guest Option Must Be Mandatory

That's quite a naïve view of how things work.

The affected data in this case was

> names, dates of birth, telephone numbers, home addresses, household information, email addresses

For a guest checkout it uses every single one of those with the exceptions of DOB and "household information". The minimum required to fulfil an order (i.e. deliver it) is the person's name and address. Then you need an email address to send updates about the delivery. There's no way that those get wiped from databases just because an order has been delivered! It's part of the audit history of a companies orders. Just because you don't have an "account" doesn't mean the details aren't saved anywhere!

As for payment card details the retailer doesn't usually store those. They store a representation (encrypted token) of the card which can then be validated with a 3rd party payment provider. That applies whether you use Guest checkout or have an account. In any event, this is really the least of anyones concerns. A card can be cancelled/replaced. Your identity...not so much.

[Recluse]

Re: Checkout As Guest Option Must Be Mandatory

Just because fields are compulsory, doesn’t mean the information has to be 100% accurate.

E.g.

Non existent phone number 01234567890

Email address - use a bespoke alias (that post hack can be deleted)

Name - Use initials for your first name

Don’t specify your gender.

Don't store payment card details.

If you give them a DOB it doesn’t have to be true.

Obviously I accept certain elements can be difficult. Wrong DOB for a credit search aint going to work.

The problem these days its almost impossible to avoid leakage - your local pharmacy probably stores your prescription details “in the cloud” and this will cover your DOB. Ditto your dentist, your optician

I don’t ever recall being asked for permission to store my details electronically (a bit like ANPR) it just seems to happen.

The real fun is going to happen when HMRC/DVLA/NHS/Passport Office get hacked.

I have zero confidence that my information is safe, you just have to make the best of a bad deal …

[MachDiamond]

Re: Checkout As Guest Option Must Be Mandatory

"The problem these days its almost impossible to avoid leakage - your local pharmacy probably stores your prescription details “in the cloud” and this will cover your DOB. Ditto your dentist, your optician"

Have a care when filling out forms if your dentist or optician really needs the information they are asking for. I don't give the optometrist my true information. In a long life, I've never used the same one twice. Mostly because they have closed up and aren't there the next time I need to have my eyes checked again or I've moved out of the area. The last time I got new glasses, I paid cash. They had no need to have much of anything in terms of personal information. I even gave them a test phone number that just rings. I stopped back by the shop a couple of days later and the glasses were ready.

If you are apply for credit, you don't have options about the information you give. Same with government documents. I doubt you'd have any issue lying on a form to get a store rewards card if they hand you the card when you hand in the form at the store. I've got a couple where I promised to send the form in later (didn't). If they all go to requiring them to be on a phone, I'll pass. The savings isn't that substantial in trade against my privacy.

[elsergiovolador]

Re: Checkout As Guest Option Must Be Mandatory

Many systems use the details you provide for fraud detection and whoever is doing fulfilment may see this as red flags and won't ship.

[brainwrong]

usable payment or card details

"We also asked what exactly it meant by "usable payment or card details." A spokesperson said: "We don't hold full card payment details on our systems, so it's masked and not usable.""

This means that they don't store the 3 digit CVV code on the back of the card, because that is a breach of contract with the payment processor. All the other details may be stored, and have been stolen by the sounds of it.

[Alister]

Re: usable payment or card details

>> All the other details may be stored

PCI DSS doesn't prohibit the storing of the full PAN, but it strongly recommends against it, and does mandate that if stored, it should be encrypted, and when displayed, should be masked.

In practice, in nearly all cases only the last four digits of the PAN are stored, and that is simply to identify the card to the user for subsequent transactions.

Actual transactions use a representative token generated by the payment provider, rather than passing the actual card details.

[MachDiamond]

Re: usable payment or card details

"A spokesperson said: "We don't hold full card payment details on our systems, so it's masked and not usable."""

Even a piece can be quite useful. A Big Data firm (black hat or white hat) could use the last 4 digits of a card number as a check against the full number they already have. What we buy tells a lot about us. A young person buying baby supplies (nappies, wipes, etc) on a regular basis has a new baby in the house. If they just bought a few things once, it could be gifts for a baby shower. Certain items bought near to religious holidays could narrow down somebody's religion, if they are religious. With enough data points, a lot of the puzzle gets filled in. The excuses companies hand out about there only being limited bits of information assumes that's all the information a miscreant will have access to.

[Tron]

There are alternatives.

Instead of company servers being data honeypots, customer data could be held on their own PCs, encrypted, and queried by the website when you go there. Once an order is complete, data on it, if it is retained by the store, should be moved to a system that is offline bar a basic, filtered data feed, or regularly, manually. The systems we have are still very much v.1.0, unchanged from how they were when the internet was young. Everything is on servers with generic connections to the public internet. Every flaw is a vulnerability. You can design most of this out.

Perhaps the easiest alternative is for companies to have a dedicated, branded store on Amazon or Ebay. The extra cost is less than they would be paying out to deal with a hack. Plus they can sell internationally more easily. Their website could be used just for advertising, linking to products on the Amazon/Ebay store.

We could also see more action from governments. Whether these hacks are by 'state actors' as they call them or not, they should still be hunting them down like terrorists rather than cashing in with fines on anyone who gets hacked. Governments talk tough but how many malware hackers have vanished or 'fallen downstairs'? Our governments are soft and lack competence.

[Anonymous Coward]

Re: There are alternatives.

Why are you assuming that Amazon and eBay aren’t going to get hacked next?

[logicalextreme]

Re: There are alternatives.

Sounds like TBL's weirdy "pods" concept, which I'd be mildly interested in if it went anywhere but haven't heard much about since it kicked off close to a decade ago. https://en.m.wikipedia.org/wiki/Solid_(web_decentralization_project)

[logicalextreme]

Re: There are alternatives.

Oh and WRT companies having their own stores on Amazon and eBay — a lot of them already do; some see it as "multi-channel" and some even end up closing down their self-run points of sale. I worked for a bricks-and-mortar entertainment (e.g. CDs, DVDs) retailer back in the day and by the time I left the company (2004 or 2005 I think) they were making most of their money selling things on Amazon Marketplace and eBay, because the overheads were lower and they could even sell the products for a higher price as customers assumed the eBay or Amazon price "must" be the cheapest.

As a mildly amusing aside, when I interviewed for my final job in their head office I got to eavesdrop on a meeting between the Accessories buyer and a supplier that was happening in reception due to lack of meeting space, wherein I discovered that the relaunched Chewits we had inexplicably been told to display in boxes at all the tills were in fact the highest-margin item in the company. ¯⁠\⁠_⁠(⁠ツ⁠)⁠_⁠/⁠¯

My personal trouble with it is that I refuse to use Amazon to the point that I've found manufacturers who literally only sell through Amazon and abandoned any hope of obtaining their wares. It must be a good business model for some as I always get in touch with them to ask if there's any way I can buy their stuff and the answer's always no. eBay I can live with though the interface is even worse than Amazon's.

[MachDiamond]

Re: There are alternatives.

"they were making most of their money selling things on Amazon Marketplace and eBay, because the overheads were lower and they could even sell the products for a higher price as customers assumed the eBay or Amazon price "must" be the cheapest."

Both of those can be one-stop shops and the search functions are often much better so you can drill down to the thing you want much more quickly. The big box DIY store near me has a horrible web site and is cumbersome to navigate. I have to keep clicking the "in-stock" box to make sure that I can go get it right now or all the parts I need for a project are available. They keep wanting to push "pick up in a few days" or "ship direct" to my home. Not that useful when I'm mending some plumbing, the water is off and I really want this done as soon as possible. I also don't want to see items that aren't available in my region or that I have to buy in pallet quantities.

[Eponymous Bastard]

Sparks, not so bright

I wonder what this calamity tells us about Marks and Spencers' recruitment and training values?

Do they employ people who will click on any link in an email?

Do they employ a company to simulate phishing attacks to help to prevent this kind of clusterfuck?

The email I received today from Jayne Wall was poorly written; perhaps AI was avoided or perhaps Jayne is another poorly educated Oxbridge PPE graduate.

I expect some Sparks offers soon . . .

[MachDiamond]

Re: Sparks, not so bright

"Do they employ people who will click on any link in an email?"

Is their system set up so some employee clicking on a phishing link creates a path into the customer database?

[Richard Tobin]

Stupid password requirements

They wont accept a password of 16 random letters and numbers because it doesn't include a special character, but they'd be happy with ABCxyz+1

[pd4361]

"recovery efforts are ongoing"

Why is it taking so long? Only two alternatives: (a) restore from the last known good backups; (b) if the backups are corrupt, or are thought to contain trojaned software, wipe back to bare metal and reinstall systems and applications from scratch. Even if they have to type in all the product data, it still shouldn't be taking this long. Maybe the IOC and/or police have declared the IT infrastructure to be a crime scene? If so, M&S should still be able to mothball the existing systems for further forensic examination, and rent new IT facilities on a temporary basis, just to get up and running again. Yes, it would be expensive. But the expenditure would almost certainly be less than the amounts that they're losing at the moment.

So many aspects of this are just baffling. Same goes for the Co-op hack.

[Anonymous Coward]

One day you may gain first hand experience of recovering compromised systems…

[Anonymous Coward]

I can imagine this sort of comment from a random non-tech manager who had been included on the breach response team.

Stressed tech teams who have been working for 3 weeks straight.... Ohhhh, why didn't I think of that! Bob, oi bob, call dell, get a bunch of tin, then go spin up a colo quickly, deploy all the systems we need, ensure replicas and backups meet our RPO/RTO objectives, ensure monitoring/observability is in place, and that security controls are implemented.... And Bob, by the end of play today please. Then we can get ops people to work 80 hours a day to re-enter all this product data, all from memory.

I'm gonna assume you have never had to recover from a breach, it's stressful, tedious, emotional. Your working you ass off, but also very aware that once the dust has settled, there is going to be a load of tough meetings/reviews. You also have no idea as to the scale of the task at hand, so please do not presume to simply the situation into 2 options.

P.S. breach recovery is also fun, but I'm sick like that

[Anonymous Coward]

And Bob! We need all the missing sales figures for, you know, trivial things like producing accurate accounts!

[Ascy]

Just got the e-mail myself.

First of all, I never enter my real date of birth into any site that doesn't have a good reason for asking for it (so use a fake DOB for pretty much everything except insurance and banks). I do wonder why M&S need it?

The e-mail also screams 'non-technical people involved in software', which often doesn't help. So my question is, if no password data was retrieved (presumably including any hopefully uniquely salted password hashes), then why do I need to change my password when I next log in? That makes no sense unless they don't believe their own statement.

Hopefully their loss in market valuation will make other companies take IT and security a little bit more seriously and encourage the raising of the competence bar (let's face it, it couldn't get much lower in the software development - my - industry). Though, I won't be holding my breath.

[David Hicklin]

> then why do I need to change my password when I next log in?

Standard boilerplate response (and yes I also have had an email)

[MachDiamond]

"then why do I need to change my password when I next log in?"

My password with the Copyright office expires after so many days and they won't let me reuse one I've used in the last 6-12 months. Pointless, unless somebody is trying to brute force my account. I have to keep a spreadsheet even though it's dead easy to click the "I forgot" and reset it any time I need to. The level of security needs to be matched with the target. If I got into the Sony Pictures account and assigned the Copyright to a feature film to me, it wouldn't fly. If somebody hacked my account and transferred rights to a stack of photos to themselves, it wouldn't be hard to show that as fraudulent. Having some sort of gate is useful to prevent fat fingered mistakes, but a high-security vault is overkill.

[PRR]

> my question is, if no password data was retrieved.., then why do I need to change my password when I next log in?

The article explained that:

> For extra peace of mind, they will be prompted to reset their password...

Are we peaceful yet?

[MachDiamond]

"Are we peaceful yet?"

A bit, we got them to admit the password files were hacked.

[Malarkey]

We have no evidence...

"will make other companies take IT and security a little bit more seriously"

Nah, not happening. They'll continue to give things like security lip service as they're driven by corporate greed.

As long as the shareholders don't tank the stock who cares about the little people ?

That M&S sat on the fact user details have been compromised means they're more concerned about their own necks than their customers...

What's next ? A year's worth of credit monitoring as long as M&S customers don't sue while they move home and change their names ?

If M&S survive this I'm sure one of the ways they'll recoup losses is by laying off shop staff and shutting some stores.

[Wexford]

It's always a "sophisticated attack", isn't it. Every time. Like they have top class security, but gee that attack was so SOPHISTICATED it was too strong even for us!

Of course it was just a phishing email that someone fell for.

[Anonymous Coward]

its in the backups

We got a brief to say that their IT support was social engineered into bypassing 2FA. From there malware was installed, and left dormant for an unknown length of time.

Each time they try to restore an older backup, the malware re-activates. i.e. seemingly they have no clean slate to work from as they don't know how long the malware was left dormant.

[JudeK]

Re: its in the backups

Anon, would you consider getting in touch with us about this? Here are some tips on how to do this: https://www.theregister.com/Profile/contact/

We always protect our sources.

Jude @The Reg

[tip pc]

Re: its in the backups

in my simple head, data and applications are separate entities.

i'd expect to be able to rebuild the servers with the apps and be able to point the applications at data that might be current or a past copy.

do entities not check their expensive backups?

are backups effectively a rolling live archive?

i remember rebuilding databases from transaction logs etc but thats not a backup.

backed up data should not be able to infect anything, i can understand how a backed up infected application server can be capable of reinfecting stuff. A freshly built server with applications freshly installed from the vendor should not be able to infect anything.

If data is infecting servers then we are all doomed.

[Anonymous Coward]

Co-Op

I went into a Co-Op store today. Flipping heck it was grim. Back to the early days of Covid, probably 50% of shelves empty?

[Anonymous Coward]

Re: Co-Op

I went to our local Co-op earlier. Lots more stuff in now than even yesterday. But so many onions that they even had nets full of them in the (otherwise bereft) fridges. So, onion dopiaza it is then for tea.