Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallGoogle Threat Intelligence and Mandiant warned in May 2025 that US retailers were being targeted with social-engineering techniques associated with UNC3944, commonly called Scattered Spider. The warning was substantially accurate, but it did not prove that one gang carried out every attack in the UK or publicly identify the US companies involved. The clearest lesson for businesses—and customers concerned about their data—is that attackers may exploit help-desk identity procedures before they deploy ransomware.
What happened, and what remains uncertain
The headline that hackers behind attacks on Marks & Spencer, Co-op and Harrods had turned to US companies captured the direction of the threat in May 2025. Google researchers said multiple US retailers were being targeted, and some attacks had succeeded. However, Google and Mandiant did not formally attribute the UK incidents to Scattered Spider, while the UK National Cyber Security Centre said it could not establish whether the incidents were linked, coordinated or unrelated attacks using similar techniques.
As an Amazon Associate I earn from qualifying purchases.
That distinction matters. “Associated with Scattered Spider” is not the same as “confirmed to have been carried out by Scattered Spider.” The US victims named in the original warning were not publicly disclosed. Claims that particular companies were victims should therefore be treated as reported, not confirmed, unless the company, law enforcement or a named investigation has said so.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →The warning was about activity observed in May 2025, not a new August 2026 development. NCC Group’s March 2026 review said Scattered Spider remained linked to high-profile US and UK attacks, while noting that it was not among the ten most prolific ransomware groups by attack volume. Google’s warning and its attribution limits are also summarized by Retail Dive.
#1 Best Overall
The three UK retail incidents
| Company | What was publicly reported | Attribution status |
|---|---|---|
| Marks & Spencer | The company disclosed a cyberattack in April 2025. Reporting linked the incident to disruption affecting online ordering, contactless payments and click-and-collect operations. Customer data was later reported stolen; payment-card information was described in contemporary reporting as masked or unusable. | Widely linked in reporting to the same activity, but the cited Google and NCSC material did not establish final attribution. |
| Co-op Group | The company disclosed a cyber incident and confirmed that attackers accessed information relating to many current and former members. | Linked by reporting and researchers to the broader activity, but not conclusively attributed in the cited material. |
| Harrods | The retailer confirmed an attempted intrusion and restricted internet access to stores as a defensive measure. Early reporting did not establish a confirmed compromise of its main network. | Connected by timing and reported techniques, but the extent of compromise was different from the other incidents. |
The UK Information Commissioner’s Office said on May 2, 2025, that it had received reports from M&S and Co-op and was working with the NCSC. That confirms regulatory involvement, not a final finding about who conducted the attacks. On July 10, 2025, the UK National Crime Agency announced four arrests connected with its investigation. Arrests are not convictions and do not prove the complete attribution chain. See the ICO statement and NCA announcement.
Who are Scattered Spider?
Scattered Spider is often used as a media shorthand for a fluid collection of English-speaking threat actors, overlapping operators and techniques—not necessarily one centralized criminal organization. Security companies and researchers may use related names including UNC3944, 0ktapus, Octo Tempest, Muddled Libra and Scatter Swine. Those labels can describe overlapping activity clusters without proving that every person using the same methods belongs to one unified group.
The group or activity cluster became associated with highly effective social engineering, particularly attacks against employees and corporate support processes. This makes the label less useful as a simple “gang” description and more useful as a way to discuss recurring tactics, infrastructure and behavior.
How the attacks work
The reported attack pattern focuses on identity and human procedures rather than a single piece of malware:
- Attackers gather information about an employee, contractor or administrator from public sources or previous compromises.
- They call or message a corporate help desk while impersonating that person.
- They create urgency—for example, by claiming a lost phone, locked account or inability to work.
- They persuade support staff to reset a password, unlock an account or enroll a new multifactor-authentication device.
- They use the recovered access to reach an identity provider, VPN, cloud environment, remote-access tool or Active Directory.
- They escalate privileges, move laterally with legitimate administrative tools and steal data.
- They may then deploy ransomware or threaten to publish the stolen information.
This is why multifactor authentication alone is not a complete defense. MFA can be bypassed when an attacker persuades an employee to reset it, abuses a weaker recovery channel, uses SIM swapping or overwhelms a user with repeated prompts. A strong primary login can still be undermined by an insecure enrollment or help-desk process.
DragonForce is not the same thing as Scattered Spider
DragonForce is described as a ransomware operation or brand that can work with affiliates. Reporting said it claimed responsibility for the three UK incidents and that the attacks used techniques associated with Scattered Spider.
Rank #3
These terms describe different parts of an intrusion:
- Threat actor: the people conducting the intrusion.
- Affiliate: an operator carrying out an attack for a ransomware operation.
- Ransomware brand: the malware, leak site or extortion service used.
- Attribution: the evidence-based judgment linking an intrusion to a particular actor.
A DragonForce claim, or the presence of DragonForce encryption, is not by itself conclusive proof that Scattered Spider conducted the entire intrusion. Ransomware operations can involve affiliates, access brokers and other participants.
Why US retailers are attractive targets
Retailers combine several features that make identity attacks especially damaging:
- Large volumes of personal, loyalty and customer-account information.
- Payment, ordering and fulfillment systems that must remain available.
- Distributed stores, warehouses, contractors, suppliers and temporary workers.
- Outsourced IT and help-desk providers with broad access.
- Pressure to restore operations quickly during busy seasons.
- High reputational costs when customer data or payments are disrupted.
The risk is not limited to a retailer’s website. A compromised account may affect point-of-sale systems, distribution centers, e-commerce, warehouse operations, loyalty programs, corporate email or virtualization infrastructure. The Retail Council of Canada, citing public reporting and Mandiant assistance, highlighted retail’s valuable personal and financial data and recommended stronger identity and privileged-access controls. Read its sector guidance.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What retailers should change now
1. Secure account recovery and help-desk workflows
- Create a separate, high-risk process for executives, administrators and service accounts.
- Require a callback to a pre-registered number or approval from a manager or security team. Never use a number supplied by the caller.
- Do not approve sensitive changes based only on caller ID, employee numbers, dates of birth or information available online.
- Use two-person approval for privileged-account recovery and new MFA enrollment.
- Log every password reset, MFA reset, SIM change and privilege change.
- Alert on unusual concentrations of sensitive resets by one help-desk agent.
- Test the process with authorized social-engineering exercises.
2. Use phishing-resistant authentication
Administrators, help-desk staff, executives and remote-access users should use phishing-resistant authentication such as FIDO2 security keys or passkeys where practical. SMS recovery should be removed from privileged accounts wherever feasible. Step-up authentication should be required for password resets, MFA enrollment and recovery-factor changes.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Security teams should also review emergency-access accounts and alert when one phone number, authenticator or recovery method is associated with multiple users. Strong authentication is more effective when recovery channels receive the same protection as normal sign-in.
Best Value
3. Improve visibility across identity and endpoints
- Ensure endpoint detection and response is active on workstations, servers, cloud workloads and administrative systems.
- Correlate identity-provider, VPN, remote-access, help-desk and endpoint logs.
- Detect suspicious remote-management tools, credential dumping and unusual administrative activity.
- Monitor VMware ESXi and other virtualization infrastructure separately.
- Restrict unnecessary outbound server traffic and block known malicious infrastructure.
4. Make recovery independent of production credentials
- Maintain offline or otherwise isolated backups.
- Keep backup and recovery credentials separate from production credentials.
- Test restoration of identity, e-commerce, point-of-sale, warehouse and payment-adjacent systems.
- Define manual procedures for stores and distribution centers.
- Measure how long critical business processes can operate manually—not merely how quickly a server can be restored.
5. Prepare the response before an incident
Retailers should establish relationships with law enforcement, outside incident responders and legal advisers before an attack. Response plans should include preserving logs and forensic evidence, revoking sessions and tokens—not only passwords—and investigating whether a compromised privileged account created persistence.
Organizations should also prepare communications for employees, customers, suppliers and franchisees, and understand applicable regulatory notification duties. A payment decision should not be automatic. It depends on backup viability, data exposure, sanctions and legal constraints, business impact, evidence that decryption is possible and the risk of further extortion. Paying does not guarantee deletion of stolen data or prevent another demand.
Questions security leaders should ask this week
- Can a help-desk agent reset a privileged user without manager or security approval?
- Can a caller enroll a new MFA device after answering knowledge-based questions?
- Are password-reset and MFA-enrollment events correlated with identity and endpoint logs?
- Can ransomware reach hypervisors, backup systems or emergency-access accounts?
- How long could stores, e-commerce and distribution operations continue manually?
What remains unknown
The full list of US victims was not publicly identified in the cited Google warning. It also remained unclear whether one actor conducted all three UK incidents, precisely how DragonForce related to each intrusion, what the final legal outcome of the arrests would be and whether later attacks represented direct continuation, imitation or affiliate activity.
The most defensible conclusion is therefore narrower than “Scattered Spider hacked every retailer involved.” In May 2025, Google and Mandiant observed US retailers being targeted with techniques associated with UNC3944/Scattered Spider, amid investigations into UK retail attacks. For retailers, the practical response is the same regardless of the final label: protect help-desk recovery, harden privileged identity, monitor MFA changes, maintain endpoint visibility and prove that critical operations can recover.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
