UK police arrest four following cyberattacks on M&S, Co-op, Harrods

• NCA arrests four people suspected of participating in recent attacks
• M&S, Co-op and Harrods all hit by cyberattacks
• Arrested group are accused of organized crime, money laundering, and more

The UK National Crime Agency (NCA) has arrested four people suspected of taking part in recent cyberattacks against M&S, Co-op, and Harrods.

An NCA press release said the police apprehended two 19-year-old males, one 17-year-old, and a 20-year-old female in the West Midlands and London, all of whom had their electronic equipment seized.

They are suspected of Computer Misuse Act offenses, as well as blackmail, money laundering, and participating in the activities of an organized crime group.

DragonForce

"Since these attacks took place, specialist NCA cybercrime investigators have been working at pace and the investigation remains one of the Agency's highest priorities,” commented Deputy Director Paul Foster, head of the NCA's National Cyber Crime Unit. "Today's arrests are a significant step in that investigation but our work continues, alongside partners in the UK and overseas, to ensure those responsible are identified and brought to justice.”

In late April and early May 2025, three major UK retailers, M&S, Co-op, and Harrods, all suffered major cyberattacks.

The hit on Marks and Spencer affected stores nationwide, and resulted in “small changes” to store operations in order to protect customers “and the business." The retailer confirmed Click and Collect services were impacted by technical issues as a result, and some stores were unable to process contactless payments.

Co-op suffered differently, as threat actors (who named themselves “DragonForce”) walked away with a hefty archive of sensitive company data, including customer information.

"This data includes Co-op Group members' personal data such as names and contact details, and did not include members' passwords, bank or credit card details, transactions or information relating to any members' or customers' products or services with the Co-op Group," the company said at the time.

"Cyber attacks can be hugely disruptive for businesses and I'd like to thank M&S, Co-op and Harrods for their support to our investigations. Hopefully this signals to future victims the importance of seeking support and engaging with law enforcement as part of the reporting process. The NCA and policing are here to help."

You might also like

• M&S, Co-Op and Harrods got hit by a cyberattack: here's what retailers need to do to stop this
• Take a look at our guide to the best authenticator app
• We've rounded up the best password managers