London’s iconic luxury department store Harrods has become the latest high-profile target in a wave of cyber-attacks rattling the UK retail sector.

The store said that following an attempt by hackers to infiltrate its systems yesterday (1st May), its IT security team had ‘restricted internet access’ at its sites, although it emphasised that online sales were still operating as normal.

In a statement, Harrods said: “We recently experienced attempts to gain unauthorised access to some of our systems.

“Our seasoned IT security team immediately took proactive steps to keep systems safe, and as a result, we have restricted internet access at our sites today.

“We are not asking our customers to do anything differently at this point, and we will continue to provide updates as necessary.”

Harrods said that its flagship Knightsbridge store, H beauty stores and airport stores all remained open to customers, but declined to give any details about the nature of the attack, or the impact to its network.

Major UK retailers appear to be under ongoing cyber-attacks, with this most recent incident following close on the heels of those suffered by both Marks and Spencer and Co-op over just the last two weeks.

The UK’s National Cyber Security Centre has confirmed that it is working with the organisations affected, with NCSC CEO Dr Richard Horne saying: “The disruption caused by the recent incidents impacting the retail sector are naturally a cause for concern to those businesses affected, their customers and the public.

“The NCSC continues to work closely with organisations that have reported incidents to us to fully understand the nature of these attacks and to provide expert advice to the wider sector based on the threat picture.

“These incidents should act as a wake-up call to all organisations. I urge leaders to follow the advice on the NCSC website to ensure they have appropriate measures in place to help prevent attacks and respond and recover effectively.”

Meanwhile, M&S continues to grapple with the fallout from its cyber assault, revealed earlier this week to be a ransomware attack linked to the Scattered Spider threat group, with chief executive Stuart Machin telling customers in a message over social media that the company is ‘working day and night’ to resolve the ongoing problems stemming from the incident.

The Easter weekend ransomware attack saw Marks and Spencer forced to halt contactless payments as well as suspend online services, with later reports that shelves were going empty across the country in the stores’ grocery sections, costing millions in lost sales and wiping around £700 million from the company’s value.

While Machin’s message said M&S looked to welcome customers to its stores over the upcoming bank holiday weekend, online and app orders still look to be down.

On Thursday, May 1st, Sky News reported that the firm has now frozen its recruitment efforts, pulling all job adverts across its UK sites, despite more than 200 being listed only last week, with M&S saying that it was ‘temporarily pausing’ some of its normal processes as it manages the cyber-attack.

After facing another attempted cyber-attack, the Co-op was reportedly forced to shut down parts of its IT systems, but reassured customers that it had taken ‘proactive steps’ to protect the network, stressing that the hack had resulted in just “a small impact to some of our back office and call centre services”.  

Recommended reading

• Scattered Spider Linked to M&S Cyber-attack Chaos
• M&S Apologises To Customers Following ‘Cyber Incident’
• How Have Cyber Experts Reacted to the M&S ‘Incident’?

While the Co-op’s reaction to the attempted intrusion, including not asking its customers to do anything differently, suggests that sensitive data was not compromised, fresh reports indicate ongoing efforts of IT teams to deal with the incident.

In an internal staff email, reported by ITV News, the Co-op warned its 70,000-strong workforce to remain vigilant of suspicious emails or links, and said that they would no longer be able to access the company’s IT systems remotely.

The instructions also told employees not to record or transcribe Microsoft Teams calls, and to keep cameras on during meetings in order to verify everyone taking part, suggesting that security teams are yet to rule out the presence of hackers.

The UK Parliament’s Business and Trade Select Committee has waded into the ongoing furore, with ITV reporting that committee chairman, Liam Byrne MP, has written to the leaders of M&S and the Co-op to seek their reassurance that the cyber-attacks are being managed effectively.