Marks & Spencer, one of the giants of British retail, has been trapped in a digital hell for more than a week. A cyberattack, supposedly carried out by the group Scattered Spider, has paralyzed its systems, halted hiring, and suspended online orders. But the worst part isn’t that. The worst part is that they didn’t even have a basic plan to deal with an attack like this. Was this an orchestrated plan against M&S?

Who are Scattered Spider?

Scattered Spider is a well-known cybercriminal group, unfortunately, made up mainly of young people from the United States and the United Kingdom. They are also known by other names such as UNC3944, Muddled Libra, Star Fraud, and Oktapus.

These young individuals have been involved in major cyberattacks, including those carried out against companies like MGM Resorts and Caesars Entertainment in 2023. They use tactics such as phishing, impersonating IT support staff, and SIM swapping to gain unauthorized access to corporate systems.

Even though some members have been arrested, the group hasn’t stopped and remains very dangerous.

No one knew what to do (literally)

One employee said it clearly to Sky News: “last week was pure chaos”. There was no protocol. No plan B. Nothing. The result? People sleeping at the office, marathon workdays, and personal phones turned into work tools because corporate devices were completely locked down.

Broken communication and suspicion everywhere

Since they don’t know how compromised the systems are, internal communication has completely collapsed. No Teams. No emails. Everything through WhatsApp. The atmosphere is pure paranoia. No one knows what’s working, what isn’t, or who might be reading what. Total disorganization at one of the country’s most well-known companies.

This disaster won’t be fixed in two days

The same worker says this will take a long time. M&S plans to bring services back little by little, cautiously, to avoid leaving the door open again. Because right now, any false restart could make things even worse. For now, customers are getting only a standard apology: that they’re working “day and night” to fix it. In the meantime, nothing works.

It’s not just M&S: this is serious

The attack on M&S isn’t an isolated case. In recent weeks, Harrods and the Co-op Group have also been victims of cyberattacks. The British government has issued an urgent warning: what we’re seeing is a wake-up call. And whoever doesn’t listen will probably be next.

Minister Pat McFadden said it bluntly: no one would leave their car unlocked. Well, this is the same, but with data. Cybersecurity is no longer a recommendation, it’s a matter of survival.

And who pays the price for all this?

Spoiler: the usual ones. The workers. Because beyond the damage to the brand image or the financial losses, what’s behind it are employees working non-stop, with no clear information, and bearing the stress of a company that simply wasn’t prepared. Endless workdays, personal phones overwhelmed, and a constant fear that the system is still compromised.

A company like M&S can’t afford this. And yet…

In 2025, not having a plan for a cyberattack is like not having fire extinguishers in a building. We’re not talking about a remote possibility. We’re talking about a certainty. It’s going to happen. And when it does, you either have a plan… or you have chaos.

M&S is learning it the hard way. And the worst part is, their employees are paying for it up front.