The latest string of cyber incidents impacting some of the UK’s most recognisable retail names – M&S, Co-op, and now Harrods – should not be viewed as isolated events a leading security expert has warned.

Speaking to Emerging Risks Jake Ives, head of security, Intersys said the attacks were “interconnected signals” of a threat landscape that is growing in complexity, persistence and business impact.

“As the National Cyber Security Centre (NCSC) noted in its recent statement, these events should serve as a wake-up call for organisations across sectors – particularly those where digital touchpoints are now integral to business operations,” he explained. “From a risk management perspective, the true cost of a cyber breach is not confined to ransom payments or system recovery.

“In retail, it rapidly becomes a full-spectrum disruption. We have seen stores unable to process contactless payments, online orders paused, Click & Collect disabled, and warehouse workers told to stay home. Staff are left fielding confused customers, while communications to the public lack clarity – in one case offering little more than: “There is an ongoing cyber incident, but don’t worry, our stores are open.” Such incidents highlight how cyber resilience now touches everything from logistics and payments to brand reputation and customer trust.”

Ives added while the full extent of the M&S breach is not yet known, some reports suggest that advanced techniques may have been used, involving credential theft and ransomware targeting virtual infrastructure.

This would prompt uncomfortable but necessary questions for boards and risk leaders: Are the principle of least privilege and strong access controls being followed? Are those privileges properly delegated in environments like Active Directory – or is Domain Admin access being granted too broadly? Are admin accounts properly segregated? Are servers protected by multi-factor authentication (MFA) and monitored comprehensively through SIEM solutions? Are critical systems patched against known vulnerabilities? How are third-party connections being monitored and secured?

“This is where traditional compliance-led approaches to cybersecurity fall short,” he continued. “UK businesses need to move beyond checklists and adopt a genuinely risk-based approach grounded in Zero Trust principles.

“MFA (ideally phishing-resistant), network segmentation, continuous monitoring, and rapid patching must become table stakes. MFA protections must also extend to servers and infrastructure components that represent high-value targets. Security controls must extend to collaboration tools like Microsoft Teams and SharePoint – with verification checks, domain allow-lists, and anonymous access restrictions rigorously enforced. Auditability, accountability, and control over external access are key, particularly when sensitive financial, HR or operational data is shared.”

He continued application whitelisting solutions such as ThreatLocker can provide early alerts when sensitive files are accessed inappropriately – a proactive way to detect lateral movement and credential harvesting attempts before ransomware is deployed.

“In a recent case involving NTDS.dit file access, while the database contains hashed credentials, attackers can still brute-force these hashes if users have not applied strong, unique passwords, Ives added. “This underscores the importance of password hygiene – weak or reused credentials remain a significant vulnerability despite hashing.

“Moreover, resilience must be embedded in governance. Cyber incident response plans should not live in isolation from business continuity and crisis communications.

“Simulated tabletop exercises should incorporate cyber scenarios and involve not just IT but also finance, HR, legal, and comms teams. Employee training must evolve too – encompassing modern threat vectors such as AI-generated deepfakes, domain spoofing, and social engineering.

“The recent MGM Resorts attack, where a threat actor used a deepfake voice to impersonate an IT admin in a call to the service desk, is a powerful example of how psychological manipulation and deepfake technology are converging.”

Ives concluded: “Ultimately, what is unfolding in the UK retail sector is a real-time case study in systemic digital risk. For risk managers, it reinforces that cyber threats are no longer ‘just’ IT’s problem – they are a board-level concern with operational, financial and reputational ramifications. The organisations that will emerge strongest from this moment are those that treat cyber resilience as more than a bolt-on – as a priority, business-critical capability requiring investment, ownership and cultural buy-in from the very top.”