Strictly Confidential — Material Disclosure Under Executed Mutual NDA Only
SECTOR / 24 · RETAIL & E-COMMERCE

Retail & E-commerce. The cybersecurity of every consumer's daily relationship with the economy.

In April 2025, Marks & Spencer was hit by a Scattered Spider / DragonForce ransomware attack — GBP 300M profit impact, GBP 700M+ market-value loss, 46-day online-order suspension. The 2024 Ticketmaster Snowflake breach exposed 560M customer records. Retail was the second-most-targeted ransomware vertical in H1 2024 per NCC Group. PULSE engineers retail infrastructure in which customer-payment data and operational-continuity systems are not addressable by an adversary that has compromised the perimeter.

Retail & E-commerce — 2024 Threat Profile

In April 2025, Marks & Spencer was hit by a Scattered Spider / DragonForce ransomware attack — GBP 300 million wiped from annual profit, GBP 700+ million from market value.

GBP 300M
Estimated annual profit impact of the April 2025 Marks & Spencer Scattered Spider / DragonForce ransomware attack — alongside GBP 700+ million market-value loss and a 46-day suspension of online orders. Initial access via TCS helpdesk social engineering.
Marks & Spencer disclosure / Reuters
560M
Ticketmaster customer records exposed in the 2024 Live Nation Snowflake-platform breach — claimed by ShinyHunters — affecting names, addresses, phone numbers, partial payment data, and order history.
Live Nation SEC 8-K / Mandiant
2nd
Most-targeted ransomware vertical in H1 2024 (consumer cyclicals — non-essential retail) per NCC Group; consumer non-cyclicals (essential retail) ranked 5th. Retailers held substantial customer-data corpora at multi-million scale.
NCC Group Threat Pulse H1 2024
PCI DSSv4.0
Payment Card Industry Data Security Standard v4.0 became fully effective 31 March 2024, with future-dated requirements becoming mandatory 31 March 2025 — substantial uplift in expected controls baseline for retailers handling cardholder data.
PCI Security Standards Council
Threat Landscape

Retail cybersecurity is the cybersecurity of every consumer's daily relationship with the economy. A breach is felt at every cash register and every browser checkout simultaneously.

The retail and e-commerce threat landscape is defined by visibility. Unlike most industries where a breach affects internal operations or specific business-customer relationships, a retail breach is felt by ordinary consumers at the cash register, at the contactless terminal, and at the e-commerce checkout — often within hours. The 2025 Marks & Spencer attack is the canonical recent illustration of public-facing consequence at strategic scale: customers across the UK could not complete contactless payments, could not collect Click & Collect orders, could not buy online for 46 days, and watched grocery-shelves remain empty as the company reverted to pen-and-paper for fresh-food and clothing supply tracking.

The April 2025 M&S attack was attributed to Scattered Spider (the same threat collective behind MGM and Caesars 2023) deploying DragonForce ransomware. Initial access was reportedly achieved through social engineering of the Tata Consultancy Services (TCS) helpdesk that runs M&S's IT support — attackers posed as one of the 50,000 people associated with the company and successfully manipulated the helpdesk into resetting an internal user's password. Within days, attackers had stolen the Windows domain's NTDS.dit file, cracked the password hashes, gained unauthorised access to M&S's network, and deployed DragonForce ransomware to encrypt virtual machines. The financial impact: GBP 300 million estimated profit impact, GBP 700+ million market-value loss, GBP 40 million per week revenue impact during the disruption per Reuters. [01]

In April–May 2025, three of the UK's most recognisable retail brands were targeted in the same campaign window — M&S, Co-op, Harrods. The Co-op confirmed customer-data exfiltration including names, dates of birth, addresses, email addresses, and phone numbers. Harrods declined to disclose financial impact. The threat-actor portfolio that hit Las Vegas casinos in 2023 is now hitting UK high street retailers in 2025.

The 2024 Snowflake-platform ShinyHunters / UNC5537 campaign exposed Ticketmaster (560 million customer records), AT&T (109 million call/text records), and other Live Nation properties through credential-based attacks against under-protected SaaS data warehouses. The 2024 Roku breach exposed hundreds of thousands of user accounts. The 2013 Target breach (40 million payment cards) and the 2014 Home Depot breach (56 million payment cards) established the template that contemporary attacks have refined: retail breaches scale automatically with retail customer-base size. [02]

NCC Group identified consumer cyclicals (non-essential retail) and consumer non-cyclicals (essential retail) as the second and fifth most-targeted ransomware verticals in H1 2024 respectively. The retailer attack pattern combines high public visibility (which cybercriminal groups exploit for negotiating leverage and reputation), seasonal pressure points (which create ransom-payment urgency at peak revenue periods), and substantial customer-data corpora (which create exfiltration opportunity at massive scale).

Common Attack Vectors

Retail attack vectors concentrate in helpdesk social engineering, POS / payment-terminal compromise, and SaaS-platform credential attacks.

The same vectors recur: vishing of IT helpdesks (M&S 2025, MGM 2023, Caesars 2023); ransomware deployment against shared retail-IT infrastructure; payment-card-data targeting via POS-malware or e-commerce skimming (Magecart-class); and SaaS-warehouse credential attacks (Snowflake 2024 affecting Ticketmaster, AT&T, Santander).

VECTOR / 01

Helpdesk Social Engineering / Vishing

The April 2025 M&S attack — like the September 2023 MGM and Caesars attacks — was achieved through Scattered Spider social engineering of an IT helpdesk. Attackers research employees on LinkedIn, call the helpdesk posing as the employee, request a password reset or MFA-enrollment-device change, and gain network access. The defence is procedural rigour at the helpdesk layer; the attack rate continues to outpace the procedural rigour.

TCS helpdesk compromised — M&S Apr 2025
VECTOR / 02

SaaS Data Warehouse Credential Attacks

The 2024 Snowflake / ShinyHunters campaign exposed Ticketmaster (560M records), AT&T, Santander, Lending Tree, Advance Auto Parts, and others through stolen credentials and missing MFA on SaaS data warehouses. The retail data was held in aggregate form on the SaaS platform; the SaaS platform configuration was the breach point.

560M Ticketmaster records — Snowflake 2024
VECTOR / 03

POS-Malware and E-commerce Skimming

Card-present (POS) and card-not-present (e-commerce skimming) payment-data theft remain persistent. The 2013 Target (40M cards) and 2014 Home Depot (56M cards) attacks established the template. Magecart-class attacks injected into e-commerce checkout flows have continued through 2024 against thousands of smaller retailers.

40M cards — Target 2013 (the template)
VECTOR / 04

Supply-Chain Compromise of Retail Vendors

Customer data held by vendors that retailers rely on (accounting firms, marketing platforms, loyalty-programme operators, returns processors) becomes the breach vector. The vendor's cybersecurity posture is the floor for the retailer's exposure to vendor-channel-mediated attack. The 2024 wave of supply-chain compromise across retail demonstrated the pattern.

Vendor-channel propagation — 2024 sustained pattern
Operational and Regulatory Impact

PCI DSS v4.0. EU GDPR. UK NIS Regs. The compliance regime around payment data has tightened materially.

The Payment Card Industry Data Security Standard v4.0 became fully effective on 31 March 2024, with future-dated requirements becoming mandatory on 31 March 2025. PCI DSS v4.0 substantially increased the controls baseline expected of retailers handling cardholder data — including stronger authentication, expanded encryption requirements, and revised vulnerability-management expectations. Retailers found non-compliant face graduated fines from the card networks (USD 5,000 to USD 100,000 per month) and potential loss of card-acceptance privileges.

The EU GDPR (Regulation (EU) 2016/679) imposes a 72-hour breach-notification obligation on retailers operating in the EU and maximum fines of EUR 20 million or 4% of annual global turnover, whichever is higher. The UK GDPR and Data Protection Act 2018 apply parallel obligations within the UK. The 2025 M&S incident triggered both UK ICO and EU regulator engagement.

For US retailers, state-level data-breach-notification laws apply in all 50 states, with substantial variation in notification windows, harm thresholds, and enforcement penalties. The California Consumer Privacy Act / California Privacy Rights Act (CCPA / CPRA) provide consumer-private-right-of-action exposure for California-resident data. The 2024 New York Department of Financial Services 23 NYCRR Part 500 amendments imposed strengthened cybersecurity expectations on financial-services-adjacent retail.

Australian retailers operate under the Privacy Act 1988 (as amended in 2022) with maximum penalties of AUD 50 million per breach. The catalysing 2022 Optus and Medibank Private breaches drove substantial regulatory tightening that applies across the retail sector.

Reframing

Retail cybersecurity is the only domain where the breach is felt by every consumer simultaneously, at every payment terminal, in every store, in every browser session, in real time.

The PULSE Position

In a PULSE-substrate retail environment, customer-payment data and operational-continuity systems are not addressable by an adversary that has compromised the perimeter.

The defining structural exposures of retail cybersecurity are payment-data aggregation and operational-continuity dependence on shared IT systems. Retailers necessarily process cardholder data at the point of every transaction; they necessarily operate POS, e-commerce, fulfilment, and customer-service systems on which every revenue-generating activity depends. The Marks & Spencer 2025 attack demonstrated the consequence at scale: a single ransomware compromise produces simultaneous disruption to contactless payment, online ordering, fulfilment, and supply-chain coordination across an entire major-retailer estate.

A retailer running PULSE substrate does not aggregate cardholder data into recoverable corpora that an adversary can extract. Card-present and card-not-present payment data exists only in the form, location, and access scope necessary for the specific transaction at the specific moment. A ransomware compromise of the retailer's perimeter does not produce exfiltrable cardholder-data corpora because no aggregated cardholder-data corpus exists. The Snowflake-class SaaS-warehouse attack reproduces no exploitable consequence because the SaaS warehouse does not hold customer-aggregated data in a form the attacker can extract.

For operational continuity, the same architectural commitment applies. POS-system integrity, e-commerce-checkout integrity, and supply-chain-coordination data are anchored cryptographically against tampering. The Scattered Spider helpdesk-vishing-class attack reproduces no actionable consequence because helpdesk credential reset cannot grant access to the operational-control plane. The means is the trade secret. We disclose it under executed Mutual Non-Disclosure Agreement only.

Strategic Briefing — Available Under NDA

Retail PULSE deployment, PCI DSS v4.0 / GDPR / state-law alignment, and POS-and-e-commerce reference architecture.

Architectural-fit assessment for major omnichannel retailer, e-commerce-pure-play, multi-brand specialty retailer, grocery, fashion, and luxury scenarios. Quantified cardholder-data residual-disclosure model under PULSE substrate. Cross-jurisdictional regulatory alignment matrix (PCI DSS v4.0 / EU GDPR / UK GDPR / state breach-notification laws / CCPA-CPRA / NY DFS Part 500 / Australia Privacy Act). Reference architecture for POS substrate, e-commerce checkout, loyalty-programme data, and supply-chain coordination.

Available under executed NDA →
Sources

All statistics on this page are drawn from publicly available reports issued by recognised industry bodies, regulators, and security research organisations. References are listed below for verification.

  1. [01]Marks & Spencer — disclosure of April 2025 cyberattack attributed to Scattered Spider / DragonForce ransomware.
  2. [02]NCC Group — Threat Pulse identifying retail as second and fifth most-targeted ransomware verticals in H1 2024.
  3. [03]PCI Security Standards Council — Payment Card Industry Data Security Standard v4.0 (effective 31 March 2024).
  4. [04]Live Nation Entertainment / Ticketmaster — 2024 SEC 8-K disclosure of Snowflake-platform breach affecting 500M+ customers.
  5. [05]European Union — General Data Protection Regulation (GDPR), Regulation (EU) 2016/679.
  6. [06]US California — California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA).
  7. [07]US New York Department of Financial Services — 23 NYCRR Part 500.
  8. [08]Australian Government — Privacy Act 1988 (Cth).
  9. [09]Verizon 2024 Data Breach Investigations Report — analysis of 30,458 security incidents and 10,626 confirmed breaches across 94 countries.
  10. [10]IBM Cost of a Data Breach Report 2024 (Ponemon Institute, sponsored by IBM, July 2024) — covering 604 organisations across 16 countries and 17 industries between March 2023 and February 2024.

PULSE Digital Security cites these sources for context only. Citation does not imply endorsement of, or affiliation with, any cited organisation. All trademarks remain the property of their respective owners.