Four individuals have been arrested by police who are probing the cyberattacks that have wreaked havoc on M&S and the Co-op. The National Crime Agency (NCA) reports that a 20-year-old woman was arrested in Staffordshire, while three males aged between 17 and 19 were detained in London and the West Midlands.
They were detained on suspicion of Computer Misuse Act offences, blackmail, money laundering and conspiracy to participate in the activities of an organised crime group. All four were detained at their houses in the early hours of Thursday. The police also took away electronic devices.
Neighbours have spoken about a huge police operation in the peaceful Staffordshire cul-de-sac where the 20-year-old was detained. They reported that dozens of NCA officers, some masked with balaclavas, turned up in the early hours today and kicked down the door of a family dwelling. Afterwards, they were spotted removing a huge quantity of electronic equipment.
Paul Foster, the chief of the NCA’s National Cyber Crime Unit, described the arrests as a “significant step” in its inquiry. But our efforts go on, with colleagues in the UK and around the world, to make sure the perpetrators are identified and brought to justice,” he said.
The cyber attacks, which started mid-April, have created enormous disruption for the two companies. Shelves at some Co-op stores were left empty for weeks, while M&S is anticipating its business to be impacted through late July, with some IT systems taking until October or November to be fully up and running.
The M&S chairman informed MPs this week that it was as if the hack was an attempt to obliterate the business. The retailer has put the cost at £300m in lost profits. Harrods was also hit in an attack that was less significant to its operations.
M&S was the initial one to be hacked. A vast quantity of private information that belonged to customers and employees was taken. The perpetrators also used malware known as ransomware, which encrypted the company’s IT systems, rendering them useless unless a ransom was paid.
The BBC established that the hackers had sent a threatening email to the M&S chief requesting payment. A couple of days after M&S was hacked, the Co-op was also attacked by perpetrators who broke into it and stole the personal details of millions of its customers and employees.
The Co-op had to concede that the data breach did occur after hackers approached the BBC with evidence that the company was underestimating the cyber attack. The BBC then learned from the criminals that the firm had severed the internet from IT networks at the last minute in order to prevent the hackers from spreading ransomware and thus causing further disruption.
Soon after Co-op confirmed that it had been hacked, upmarket retailer Harrods confirmed that it also had been targeted and had been left with no choice but to shut down its IT systems from the internet to prevent the thieves.
The four individuals taken into custody are a 17-year-old British male from the West Midlands, a 19-year-old British man from London, a 19-year-old Latvian male from the West Midlands and a 20-year-old British woman from Staffordshire. The NCA added that its activity was assisted by officers from the West Midlands Regional Organised Crime Unit and the East Midlands Special Operations Unit.
