According to Reuters today, Archie Norman, Marks & Spencer chairman (M&S), has told lawmakers that a group named Dragonforce were the instigators behind the cyberattack. 

The cyberattack, which largely impacted M&S during the months of April and May, caused the retailer to pause online shopping for six weeks and cost the business an estimated £300m loss in profits. The retailer is yet to restore its click and collect services.  

The cyber-attackers gained access to the retailer’s internal system via social engineering tactics such as impersonating legitimate employees.  

Norman told lawmakers on parliament’s Business and Trade Committee that “loosely aligned parties” came together for the cyberattack.  

“We believe in this case there was the instigator of the attack, believed to be Dragonforce, who were a ransomware operation based we believe in Asia.” 

Last week, on the impact of the cyberattack, CEO Stuart Machin, told investors that most of the fallout should be over by August.  

Dragonforce – who are additionally tied to the Co-op and Harrods hacks – have been active since 2023 and are allegedly operating from Malaysia. The original suspects – a group named Scattered Spider – do not appear to be related to the crime.