Marks & Spencer’s chief executive, Stuart Machin, was sent a disturbing ransom demand by hacker group DragonForce in an email seen by the BBC, dated 23 April.

The email was sent from the hijacked account of an IT worker linked to Indian tech firm Tata Consultancy Services (TCS), which has provided long-term IT support to M&S. The message was also copied to seven other senior executives and included racist language and extreme, abusive rhetoric.

“We have marched the ways from China all the way to the UK and have mercilessly raped your company and encrypted all the servers,” the hackers wrote, alongside a link to a darknet portal where the group urged M&S to “message us, we will make this fast and easy.”

The hackers claim to have crippled M&S’s IT systems and stolen data from millions of customers. The message also referenced details from the company’s cyber-insurance policy and ended with an image of a fire-breathing dragon.

Nearly three weeks after the email was sent, M&S acknowledged that customer data “may have been stolen” but has not officially confirmed the identity of the attackers or whether a ransom has been paid.

TCS has distanced itself from the message, telling the BBC that the message was not sent from its own systems and that it is still investigating whether it served as the entry point for the breach.

The extortion email also establishes a direct link between the M&S hack and a separate ransomware attack on the Co-op, which has left some of its stores struggling with stock shortages since late April. DragonForce has claimed responsibility for both incidents.

DragonForce operates as a ransomware-as-a-service group, allowing affiliates to use its malware and extortion infrastructure in return for a 20% cut of any ransom paid. While the group’s origins remain unclear – some researchers believe it is based in Malaysia, others in Russia – the email to M&S suggests a Chinese connection.

Recommended reading

• PwC Interview | How Agentic AI is Reshaping Business
• Report: Enterprise AI Agent Adoption Set to Soar in 2025
• UK Orgs Have High Hopes for Agentic AI ROI

Cybersecurity experts suspect that the attackers behind both the M&S and Co-op breaches may be affiliated with the decentralised hacking community known as Scattered Spider – a loosely organised group of mainly Western teenagers known for their coordination across platforms like Discord and Telegram.

Despite the hackers’ threats, no stolen data from M&S or Co-op has yet appeared on DragonForce’s darknet leak site.

Ironically, when speaking to the BBC, the group claimed it is facing “IT issues” but promised to release information “very soon.”