Four people have been arrested by the National Crime Agency (NCA) as part of an investigation into a wave of cyber-attacks that caused widespread disruption at Marks & Spencer, the Co-op and Harrods.
A 20-year-old woman was detained in Staffordshire, while three males — aged 17 to 19 — were arrested in London and the West Midlands on Thursday morning. One of the suspects, a 19-year-old man, is from Latvia. The rest are UK nationals.
They were arrested on suspicion of offences under the Computer Misuse Act, blackmail, money laundering, and involvement in an organised crime group. Officers also seized electronic devices from their homes during the operation.
READ MORE: Marks and Spencer marketing chief steps down as cyber attack fallout rumbles on
The arrests follow months of chaos for some of the UK’s best-known retailers, starting with an attack on M&S in April. That breach saw sensitive data from both customers and staff stolen, and ransomware deployed across its systems — disabling networks and prompting an extortion demand emailed directly to the M&S chief executive. The company expects some systems won’t be fully operational again until autumn and has estimated £300 million in lost profits.
Co-op was attacked days later. Hackers also stole personal data from staff and customers, with the company only confirming the breach after criminals contacted the BBC with evidence. The retailer narrowly avoided ransomware deployment after severing internet access to key systems.
Harrods was also targeted, but appears to have avoided serious disruption after taking similar preventative steps.
Paul Foster, head of the NCA’s National Cyber Crime Unit, described the arrests as a “significant step” in the investigation, but said more work was needed. “Our work continues, alongside partners in the UK and overseas, to ensure those responsible are identified and brought to justice,” he said.
The arrests were made with support from the West Midlands Regional Organised Crime Unit and the East Midlands Special Operations Unit.
