Cyber attack on M&S involved ‘sophisticated impersonation’, chairman says
The chairman of Marks & Spencer has told MPs the company is “still in the rebuild mode” and will be for “some time to come” following a cyber attack which led to empty shelves and limited online operations for months.
Speaking publicly for the first time since the attack, Archie Norman declined to answer whether the business had paid a ransom.
“It’s a business decision, it’s a principal decision,” he told members of the Business and Trade Committee (BTC).
“The question you have to ask is – and I think all businesses should ask – is, when they look at the demand, what are they getting for it?
“Because once your systems are compromised and you’re going to have to rebuild anyway, maybe they’ve got exfiltrated data that you don’t want to publish. Maybe there’s something there, but in our case, substantially the damage had been done.”
Money blog: 10 happiest and unhappiest professions for shift workers
When asked again later in the BTC evidence session, Mr Norman said, “We’re not discussing any of the details of our interaction with the threat actor, including this subject, but that subject is fully shared with the NCA [National Crime Agency].”
“We don’t think it’s in the public interest to go into that subject on it, because it is a matter of law enforcement”, he added.
What happened?
The initial entry into M&S’s systems took place on 17 April through “sophisticated impersonation” that involved a third party, Mr Norman said.
It was two days later, on Easter Saturday, before the company became aware of the attack, and approximately a week after the intrusion, before the retailer heard directly from the attacker.
Please use Chrome browser for a more accessible video player
Who is behind M&S cyberattack?
A day later, after learning of the attack, the authorities were notified, while customers were told on Tuesday, MPs heard.
As well as British authorities, the US FBI was contacted, who are “more muscled up in this zone” and were “very supportive”, Mr Norman said.
By the time the breach is clear, systems have already been compromised, the chairman said.
The group behind the attack may have been Scattered Spider, some of whom are believed to be English-speaking teenagers, but Mr Norman said M&S made an early decision that no one from the company would deal directly with the so-called “threat actor”.
“Anybody who’s suffered an event like ours, it would be foolish to say there’s not a thousand things you’d like to have done differently,” he added.
Advice for businesses
In a warning to other businesses, M&S’s general counsel and company secretary Nick Folland said firms should be prepared to operate without IT systems.
“One of the things that we would say to others is make sure you can run your business on pen and paper,” he said.
Awareness and planning for the threats of cybersecurity meant M&S had trebled the number of people working on cybersecurity to 80and doubled its expenditure.
“We curiously doubled our insurance cover last year”, Mr Norman added.
In a good position
The business was better positioned to deal with the strike than at the start of Mr Norman’s tenure, he said.
“The context of M&S is when I joined the business, it was a very broken business… our systems were in a pretty decrepit state.”
“So I have to say if this has happened then I think we would have been kippered.”
Read more:
UK to miss deadline to agree steel and aluminium tariffs
Flavour of what’s to come as first Post Office inquiry lays bare heart-breaking legacy
Recent profits meant the company was “muscled up”.
“Extensive” insurance cover means M&S expects to make an “unsurprisingly significant claim” and receive “substantial recovery”, though the process of finding out how much will take about 18 months.
The £300m sum M&S said it expected to lose as a result of the cyber attack does not include money it expects to claim via insurance. The financial hit was calculated at £300m as the chain department store was losing £10m a week by not operating online.
The incident has “not really” affected its future, Mr Norman said.
The UK has come a “step closer” to having direct, high-speed rail connections to Germany, the Department for Transport has said.
A partnership between international train operator Eurostar and German national rail company Deutsche Bahn (DB) has “set the foundation” for a fast rail connection between Britain and Europe’s largest economy, the businesses announced on Thursday.
It means the companies are exploring options to offer direct services between London and Cologne and Frankfurt.
Money blog: Major airport increasing drop-off charge
Such direct services would mean reaching Cologne in four hours, and Frankfurt in less than five from the capital city.
At present, rail passengers have to change trains in Brussels to reach those cities. It takes at least five-and-a-half hours to reach Frankfurt, and four-and-a-quarter hours to arrive in Cologne.
Cologne Central Station could soon be served by trains from the UK. Pic: AP
The proposed services would use existing lines and infrastructure. Passengers would board a double-decker Eurostar in London, and be spared a change of trains on the continent.
The ambition to create such links had already been announced, as had a plan to allow direct rail travel from London to Geneva, but the partnership between DB and Eurostar had not.
Will it definitely happen?
Details and technicalities are yet to be worked out, with the German train company highlighting that any services are contingent upon “the necessary technical, operational, and legal prerequisites being met”.
“Implementation by individual railway companies is considered extremely difficult,” DB said.
“Joint partnerships are therefore crucial.”
What about Berlin?
Nothing was announced for a direct service to Berlin on Thursday, despite Transport Secretary Heidi Alexander singling out the benefits and prospect of journeys from London to the German capital in July.
“The Brandenburg Gate, the Berlin Wall and Checkpoint Charlie – in just a matter of years, rail passengers in the UK could be able to visit these iconic sights direct from the comfort of a train, thanks to a direct connection linking London and Berlin,” she said at the time.
A high-speed Eurostar train heading towards France. File pic: PA
Shorter journeys, like those to Frankfurt and Cologne, are seen as more commercially viable than the current 10-hour train journey time to Berlin.
Market studies conducted by Eurostar found travellers are comfortable with international rail journeys of up to six hours.
“Our research indicates that many would choose rail over air for trips within this timeframe,” Eurostar told Sky News. “This, combined with strong business and leisure demand on this route, is why we have prioritised London to Frankfurt.”
Read more from Sky News:
Petrofac administrators eye North Sea sale by Christmas
Submarine hunting pact signed by UK amid Russian threat
The Department for Transport said the focus on the two German cities was a commercial decision by Eurostar and DB, and the UK-Germany rail taskforce, established over the summer, could pave the way for further route announcements.
The energy regulator has confirmed plans for a massive upgrade to the UK’s energy grids, adding £108 to customer bills by 2031.
Ofgem said on Thursday that the £28bn investment over the next five years would bolster resilience in the transition to a renewable energy future and that much of the bill would be offset by increased efficiency.
It pointed to estimated savings for households of around £80 because of the planned investment in gas and power infrastructure, leaving a net additional contribution of £28.
Money latest: Is property still a good investment?
Ofgem said the £28bn sum formed part of an estimated £90bn to be invested in the energy networks by 2031, with “adaptive” funding arrangements helping to shield customers from volatility in the market.
Most of the funding announced on Thursday will go towards maintaining gas networks, which will remain a key source of energy as green power capacity is built up further.
“Investing now to maintain world-class resilience and expand grid capacity is the most cost-effective way to harness clean power, support economic growth and protect the country from gas price shocks like the one seen in 2022”, Ofgem said.
Please use Chrome browser for a more accessible video player
What’s driving energy prices higher?
Then, Russia’s invasion of Ukraine and Europe’s refusal to buy Russian gas in response, meant that energy bills hit unprecedented levels and gave birth to the wider cost-of-living crisis as higher energy costs were passed on across the economy.
Read more: Paying up front for energy future should lead to tangible savings
Ofgem made its announcement as costs of government energy policy and other upgrades make the biggest upwards contributions to household bills. However, the budget moved to take away some costs from April next year.
Ofgem boss Jonathan Brearley said: “The funding announced today will keep Britain’s energy network among the safest, most secure and resilient in the world. The investment will support the transition to new forms of energy and support new industrial customers to help drive economic growth and insulate us from volatile gas prices.
“But this is not investment at any price. Every pound must deliver value for consumers. Ofgem will hold network companies accountable for delivering on time and on budget, and we make no apologies for the efficiency challenge we’re setting as the industry scales up investment.
“We’ve built strong consumer protections into these contracts, meaning funds will only be released when needed and clawed back if not used. Households and businesses must get value for money, and we will ensure they do.”
Please use Chrome browser for a more accessible video player
‘It’s either keep warm or eat’
A Department for Energy Security and Net Zero spokesperson said: “This government is taking action to bring down energy bills for families, with the budget taking an average £150 of costs off bills in April, and expanding our £150 Warm Home Discount to over six million families.
“Upgrading our gas and electricity networks after years of underinvestment is essential to keep the lights on and ensure energy security for our country. Without these plans, which were first set out under the previous government, costs would spiral and our security would be compromised.
“The only way to bring down bills for good and get off the fossil fuel rollercoaster is with this government’s mission to deliver clean homegrown that we control.”
-
Sports2 years agoStory injured on diving stop, exits Red Sox game
-
Sports3 years ago‘Storybook stuff’: Inside the night Bryce Harper sent the Phillies to the World Series
-
Sports2 years agoGame 1 of WS least-watched in recorded history
-
Sports3 years agoButton battles heat exhaustion in NASCAR debut
-
Sports3 years agoMLB Rank 2023: Ranking baseball’s top 100 players
-
Sports4 years ago
Team Europe easily wins 4th straight Laver Cup
-
Environment3 years agoJapan and South Korea have a lot at stake in a free and open South China Sea
-
Environment1 year agoHere are the best electric bikes you can buy at every price level in October 2024