The wave of recent ransomware and identity-based attacks on retail giants, including Marks & Spencer, Co-op and Harrods, has sent shockwaves through the business community. Orchestrated by the sophisticated threat group Scattered Spider alongside the ransomware-as-a-service outfit Dragon Force, these coordinated attacks caused millions in losses and weeks of disruption.

These incidents, driven by identity-based breaches and ransomware, disrupted operations, exposed millions of customer records and caused substantial financial losses. Crucially, they underscore the urgent need for proactive security measures, especially around third-party access, identity protection and incident response preparedness.

While these incidents targeted the retail sector, they serve as a crucial wake-up call for every organisation, regardless of its industry.

The Alarming Scale of the Attacks 

Attendees of our Retail Attacks, Business Lessons: 5 Critical Actions All Businesses Must Take to Strengthen Security Webinar were asked:

“What surprised you most about the recent wave of attacks?” 

 
Most answered: “The scale and coordination across all brands.” 

While phishing and isolated breaches are expected, many were unprepared for how synchronised these attacks were. This marks a strategic shift: attackers are collaborating. Defenders must do the same. Shared intelligence and unified defences are now business-critical. 

Why All Sectors Should Be Concerned

These attacks did not exploit firewalls or software flaws alone—they capitalised on the following:  

• Stolen identities
• Exploited SaaS tools and communications platforms
• Compromised supply chains
• Human vulnerabilities

In fact, during our recent Retail Attacks, Business Lessons: 5 Critical Actions All Businesses Must Take to Strengthen Security, we asked attendees:

“What’s the biggest cyber security challenge your organisation is facing today?”

The majority responded:

Training staff to avoid social engineering.

This concern is well-founded. The most surprising revelation for many wasn’t just the attack itself—but the scale and level of coordination across multiple brands. These were not opportunistic hacks—they were orchestrated campaigns.

Attackers are increasingly bypassing technical controls by targeting people, using tactics like phishing, MFA fatigue and impersonation.

But training alone isn’t enough.

Cyber security must be driven from the top down. Senior leaders need to champion cyber awareness as a core business priority—not just an IT issue. When leadership visibly reinforces the importance of security hygiene, employees are far more likely to take it seriously. Building a resilient organisation requires both informed staff and active engagement from executives who understand the risks and model best practices.

What Is Security Hygiene & Why It Matters

Security hygiene refers to the routine practices and behaviours individuals and organisations adopt to maintain strong cyber security health and reduce risk. Just as personal hygiene prevents illness, good security hygiene helps prevent breaches, data loss and system compromise.

Many of today’s cyberattacks, including those targeting M&S, Co-op and Harrods, began not with a system flaw, but a human vulnerability: a leaked password, a clicked phishing link, or a compromised contractor. That’s why improving security hygiene is everyone’s responsibility, not just IT’s.

But hygiene doesn’t happen in isolation. It must be championed by leadership and embedded into company culture. When senior stakeholders reinforce its importance—by talking about it, modelling good practices and investing in training—employees are more likely to take it seriously.

In short, good security hygiene is the foundation of cyber resilience. Without it, even the most advanced tools can fail.

Investing Beyond Tools

When asked where they were prioritising future investment, attendees overwhelmingly pointed to:

• Phishing simulations
• Employee cyber awareness programmes

This reinforces the message: technical controls alone are not enough!

While tools like MFA and endpoint detection are essential, human behaviour remains the most exploited weakness. That’s why organisations are investing in practical, people-focused defences—not just awareness campaigns, but realistic, scenario-based learning.

One of the most effective methods? Tabletop exercises!

What Are Tabletop Exercises?

These structured simulations allow cross-functional teams—from IT to HR to legal—to rehearse a coordinated response to a cyberattack in a low-risk, high-learning environment. It’s not just about knowing what to do—it’s about practising it, identifying gap and building confidence across the organisation.

Pairing phishing simulations with tabletop exercises ensures that both individual users and leadership teams are prepared to recognise, respond to and recover from real-world threats.

To move from awareness to action, organisations need a clear, practical roadmap for strengthening their cyber defences. Whether you're in retail, finance, healthcare or beyond, the fundamentals remain the same. Below are five critical security actions every business must implement to build real resilience—before the next attack strikes.

5 Critical Security Actions All Businesses Must Implement

To build real cyber resilience, businesses must go beyond firewalls and antivirus software. It requires a layered approach—blending identity security, data protection, detection, human awareness and tested incident response.

1. Lock Down Identity & Access

With identity-based attacks now the most common entry point, securing user access is non-negotiable.

• Zero Trust Framework: Never trust by default—always verify every user, device and app.
• Strong MFA: Adopt phishing-resistant methods like FIDO2 keys or Microsoft/Google Authenticator apps.
• Role-Based Access Controls: Grant only the permissions necessary for each role—no more, no less.
• Identity Monitoring: Detects risky activity, such as impossible travel or leaked credentials.
• Lifecycle Governance: Deactivate accounts immediately upon employee or contractor departure.

2. Protect Your Data Like Gold

Your data is what attackers want—protect it as if your business depends on it (because it does).

• Data Discovery & Classification: Know what sensitive data you hold and where.
• Encryption: Secure data at rest and during transfer.
• Data Loss Prevention (DLP): Monitor for and block unauthorised downloads, uploads and use of USB devices.
• Context-Aware Access: Restrict access based on location, device security and behaviour.
• Data Usage Auditing: Log unusual activity—such as mass downloads before someone exits the business.

3. Invest in 24x7 Threat Detection 

Cybercriminals don’t clock off at 5PM—and neither can your defences.

• Build or Partner with a 24x7 SOC: Use tools like Microsoft Sentinel to centralise and analyse log data.
• Incorporate Threat Intelligence: Include feeds from open source, dark web and sector-specific intelligence.
• Automate Response: Use SOAR tools to deactivate accounts, quarantine devices or isolate networks instantly.

4. Harden the Human Layer

As highlighted in our webinar survey, social engineering remains the #1 concern for most organisations. It’s time to strengthen the human firewall.

• Security Awareness Training: Move beyond phishing emails—educate users on MFA fatigue, vishing, quishing and deepfake threats.
• MFA Hygiene: Reinforce the rule: never approve an MFA prompt you didn’t initiate.
• Run Tabletop Exercises: Simulate breach events across departments to improve preparedness.
• Enforce Financial Verification Policies: Use “four-eyes” checks for payments to prevent CEO fraud.
• Protect Your Executives: Senior staff are prime targets for spear-phishing—apply tighter controls.

5. Operationalise Incident Response

 An untested Incident Response (IR) plan is no better than no plan at all.

• Test IR Plans Regularly: Use real-world simulations to validate your processes.
• Cross-Department Engagement: IR is not just for the IT team—include Legal, HR, Finance and Communications as well.
• Penetration Testing: Conduct annual tests and act on the findings.
• Automate Key Responses: Preconfigure account disabling, session revocation and network isolation.
• Include Your Supply Chain: Ensure partners and vendors are factored into your incident response framework.

Resilience Over Reaction

You cannot prevent every breach—but you can detect, contain, and recover faster than the attackers expect. The key is proactive investment in people, processes and platforms.

Because the worst time to start securing your business… is after it’s already been breached.