Joe Tidy
Cyber correspondent, BBC World Service
Getty Images / PA
Four people have been arrested by police investigating the cyber-attacks that have caused havoc at M&S and the Co-op.
The National Crime Agency says a 20 year old woman was arrested in Staffordshire, and three males – aged between 17 and 19 – were detained in London and the West Midlands.
They were apprehended on suspicion of Computer Misuse Act offences, blackmail, money laundering and participating in the activities of an organised crime group.
All four were arrested at their homes in the early hours on Thursday. Electronic devices were also seized by the police.
Paul Foster, head of the NCA’s National Cyber Crime Unit, said the arrests were a “significant step” in its investigation.
“But our work continues, alongside partners in the UK and overseas, to ensure those responsible are identified and brought to justice,” he added.
The hacks – which began in mid April – have caused huge disruption for the two retailers.
Some Co-op shelves were left bare for weeks, while M&S expects its operations to be affected until late July, with some IT systems not fully operational until October or November.
The chairman of M&S told MPs this week that it felt like the hack was an attempt to destroy the business. The retailer has estimated it will cost it £300m in lost profits.
Harrods was also targeted in an attack that had less impact on its operations.
A wave of attacks
M&S was the first to be breached. A huge amount of private data belonging to customers and staff was stolen.
The criminals also deployed malicious software called ransomware scrambling the company’s IT networks making them unusable unless a ransom was paid.
The BBC revealed that the hackers had sent an offensive email to the M&S boss demanding payment.
A few days after M&S was breached the Co-op was also targeted by the criminals who broke in and stole the private data of millions of its and staff.
The Co-op was forced to admit that the data breach had happened after hackers contacted the BBC with proof that the firm was downplaying the cyber attack.
The BBC later discovered from the criminals that the company disconnected the internet from IT networks in the nick of time to stop the hackers from deploying ransomware and so causing even more disruption.
Shortly after Co-op announced it had been attacked, luxury retailer Harrods said it too had been targeted and had been forced to disconnect IT systems from the internet to keep the criminals out.