What the 2025 attacks on UK retailers show about impersonation and identity checks

Marks & Spencer suspended online orders after its April 2025 cyber attack. At the Co-op, disruption to distribution affected supplies to stores. The Cyber Monitoring Centre’s June assessment said the available indicators suggested the same attacker had targeted both retailers. It excluded a contemporaneous incident at Harrods because too little was known about its cause and impact.

On 8 July 2025, Marks & Spencer chairman Archie Norman told a Commons subcommittee that an attacker posing as an individual had used that person’s details to gain entry on 17 April. He said a third party was involved in the initial access. M&S testimony, question 168.

How a colleague’s account was reset

At the same hearing, Co-op group chief digital information officer Rob Elsey said the attackers had impersonated a colleague and answered a number of security questions to obtain an account reset. He said malicious use began about an hour later and the Co-op’s defenses detected it within minutes. Co-op testimony, questions 194 and 197.

The two witnesses described different events. Elsey explained how the Co-op account was reset. Norman identified third-party involvement at M&S but did not describe a reset through the same process.

For a retailer reviewing its own controls, the practical question is what evidence a member of staff needs before acting on a request to restore access.

An outsourced desk is still your perimeter

Where a supplier has authority to reset credentials, the retailer can check how the contract specifies proof of identity, exceptions and escalation, alongside the time allowed to resolve a ticket.

This is the part worth taking to your own arrangements. The question is not whether your provider is competent, because they usually are. The question is what a helpful agent under time pressure is permitted to do when somebody who sounds credible says they are locked out and needs access before a deadline.

Interrupted trading and exposure of personal data

In its 21 May 2025 full-year results, M&S estimated that the incident would reduce 2025/26 operating profit by about £300 million before mitigation, insurance and trading actions. The Cyber Monitoring Centre subsequently classified the two incidents as a single Category 2 systemic event and estimated a total financial impact of £270 million to £440 million across affected parties, including suppliers.

The Centre attributed most of its estimated cost to business interruption. M&S faced weeks of interrupted trading online. The Co-op told the committee that its stores stayed open and its payment systems kept operating, while distribution teams reverted to manual processes. It also reported that the attackers had copied members’ personal information.

A board reviewing business continuity needs to know which systems take orders, authorize payments and replenish stock, and how long each would take to restore. These operational costs belong alongside the consequences for people whose data was taken.

What is reasonable to ask a provider

Three questions are worth putting to whoever runs your service desk, and the value is in the specificity of the answers rather than in the fact of asking.

• What proof of identity is required before a privileged credential is reset, and who is permitted to waive it? A process with a documented exception route is more honest than one that claims never to bend, and the exception route is where the risk lives.
• What is the agent measured on? Where handling time is the primary metric, verification is the step that gets compressed, and no amount of policy language changes that incentive.
• What happens when the caller is persistent or senior? A rehearsal can show whether staff follow the escalation procedure when a caller presses for an exception.

Rehearsal beats policy

The organizations that handle this well tend to have run the scenario rather than written it down. A short exercise in which somebody plausible calls the desk and asks for access reveals more about the real procedure than a review of the documented one, and it tends to be uncomfortable in a way that produces change.

This is the argument for treating training as an operational control rather than an annual compliance task. Staff who have been walked through the specific approaches used against organizations like theirs behave differently on the call, and the people who most need that rehearsal are often the ones furthest from the security function.

The same reasoning applies to the wider estate. A cybersecurity review that examines systems without examining the human procedures wrapped around them will conclude that the controls are sound, and in the technical sense it will be right.

Where this leaves the board

Three things are worth establishing, and none of them requires a technical briefing to understand.

1. Who, inside the organization and outside it, can reset access to a privileged account, and what they would need to see before refusing.
2. How long it takes to restore the systems for orders, payments or stock replenishment, and when the recovery times were last tested.
3. Whether the identity-verification steps in your outsourcing contracts are specified at the same level of detail as the response times.

The retailers hit in 2025 were not careless organizations, and that is the uncomfortable part. They were large, well-resourced businesses whose incidents show that identity-verification procedures deserve the same scrutiny as technical defenses. For a longer account of how ordinary organizational habits become the opening, our Book of the Month shelf has The Cuckoo’s Egg, which remains the clearest description of an intruder moving patiently through systems that were working exactly as designed.