Three people arrested in the West Midlands for retail cyber attacks at M&S, Co-op and Harrods

Four people have been arrested in the UK as part of a National Crime Agency investigation into cyber attacks targeting M&S, Co-op and Harrods - including three from the West Midlands.

Two males aged 19, another aged 17, and a 20-year-old female were apprehended in the West Midlands and London this morning (10 July) on suspicion of Computer Misuse Act offences, blackmail, money laundering and participating in the activities of an organised crime group.

All four were arrested at their home addresses and had their electronic devices seized for digital forensic analysis.

The arrests included a 17-year-old British man from the West Midlands, 19-year-old Latvian man from the West Midlands, 19-year-old British man from London and 20-year-old British woman from Staffordshire.

They remain in custody for questioning by officers from the NCA's National Cyber Crime Unit in relation to the three attacks, which took place in April this year.

A spokesperson for the NCA said: “The NCA leads the UK's response to cybercrime. We work closely with partners to protect the public by ensuring cyber criminals cannot act with impunity, whether that be by bringing them before the courts or through other disruptive and preventative action.”

It comes after investigations by NCA into attacks against the three retailers, where hackers sought ransom payments after breaking into their IT systems. 

M&S shut down a raft of systems on Easter Sunday

M&S was the first of the retailers to be targeted by the hackers, with the retailer shutting a raft of systems down in response on Easter Sunday.

The company said the cyber attack has cost the firm around £300 million after it shut down its website for six weeks.

Meanwhile, Co-op saw payments disrupted and shelves become bare from May because of the fallout of its cyber attack.

Hackers also stole Co-op members’ personal data, such as names and contact details.

Harrods restricted internet access across its websites in May following attempts to gain unauthorised access to its systems.

The arrests mark a breakthrough in police efforts to investigate the attacks, which had been linked to the Scattered Spider group of hackers.

It came days after M&S chairman Archie Norman told MPs that two other “large British companies” have been impacted by unreported cyber attacks in recent months, as he detailed the “traumatic” attack on the historic retailer.

An M&S spokeswoman said: “We welcome this development and thank the NCA for its diligent work on this incident.”

A Co-op spokeswoman said: “Hacking is not a victimless crime.

“Throughout this period, we have engaged fully with the NCA, and relevant authorities and are pleased on behalf of our members to see this had led to these arrests today.”

'The investigatin remains one of the Agency's highest priorities'

Deputy Director Paul Foster, head of the NCA's National Cyber Crime Unit, added: "Since these attacks took place, specialist NCA cybercrime investigators have been working at pace and the investigation remains one of the Agency's highest priorities.

"Today's arrests are a significant step in that investigation but our work continues, alongside partners in the UK and overseas, to ensure those responsible are identified and brought to justice.

"Cyber attacks can be hugely disruptive for businesses and I'd like to thank M&S, Co-op and Harrods for their support to our investigations. Hopefully this signals to future victims the importance of seeking support and engaging with law enforcement as part of the reporting process. The NCA and policing are here to help."

Today's operational activity was supported by officers from the West Midlands Regional Organised Crime Unit and the East Midlands Special Operations Unit.

Victims of cybercrime should use the Government's Cyber Incident Signposting Site for direction on which agencies to report an incident to.