Four people in the UK have been arrested in a National Crime Agency investigation into the cyber-attacks which hit Marks and Spencer, Co-op Group, and Harrods in April 2025.

Two men aged 19, one aged 17, and a woman aged 20, were taken into custody after being arrested at their respective homes in London, Staffordshire, and the West Midlands. The West Midlands Regional Organised Crime Unit and the East Midlands Special Operations Unit assisted in the operation.

Several electronic devices were also seized for forensic analysis, as the four were arrested as suspects for breaching the Computer Misuse Act of 1990, as well as committing blackmail, laundering money, and participating in organised crime.

“Since these attacks took place, specialist NCA cyber-crime investigators have been working at pace and the investigation remains one of the agency’s highest priorities,” said NCA National Cyber Crime Unit deputy director Paul Foster.

“Today’s arrests are a significant step in that investigation but our work continues, alongside partners in the UK and overseas, to ensure those responsible are identified and brought to justice.”

Further details of the arrests remain limited, as the investigation is ongoing and highly vulnerable.

No affiliation to a cyber-crime organisation has been officially made, though previously credit for the cyber-attacks has been often given to Scattered Spider.

Recommended reading

• M&S Boss Claims Major UK Hacks Are Going Unreported
• M&S Targets August for Full Online Recovery
• Comment | Inside the Ongoing M&S Ransomware Crisis

Scattered Spider usually employees social engineering tactics to infiltrate systems and hold organisations ransom. Unlike many major cyber-crime organisations, Scattered Spider is usually made of young, native English speakers.

The attacks against UK retailers involved social engineering which may have targeted a third-party supplier, and resulted in disruption to operations and services. In the case of M&S, the fallout has lasted months, and the retailer as yet to make a full recovery.

“Hopefully, this signals to future victims the importance of seeking support and engaging with law enforcement as part of the reporting process. The NCA and policing are here to help,” Foster said.