Dear M&S Security Team

Dear Marks & Spencer Security Team,

We need to talk about Easter weekend.

£300 million. Six weeks offline. Your busiest retail period of the year, and customers couldn't buy anything online. All because Scattered Spider social engineered their way past your contractor defenses.

We know you're dealing with the aftermath—the investigations, the board meetings, the endless questions about "how did this happen?" So we wanted to reach out with what we're seeing from the outside, because there are lessons here that go beyond M&S.

Scattered Spider didn't use a sophisticated zero-day exploit. They didn't bypass your firewalls or crack your encryption. They made a phone call. They targeted your contractors—third parties with legitimate system access but probably not the same security oversight as internal employees.

Someone answered the phone. Someone believed what they heard. Someone granted access. And your entire online shopping infrastructure went dark.

You're probably asking: "How did our security awareness training fail?" It probably didn't. Your contractors likely knew about social engineering in theory. They just didn't recognize it when they were the target.

"Why didn't our access controls stop this?" Because if a phone call can override your authentication, you don't have access controls—you have access suggestions.

Here's what went wrong at the fundamental level: Your contractors had broad system access without controls that could resist social engineering. Multi-Factor Authentication (MFA) wasn't enforced or wasn't resistant to bypass—phone-based authentication can be socially engineered, Short Message Service (SMS) codes can be intercepted.

Third-party access was treated as lower risk than internal access. Scattered Spider knew this. They targeted contractors because external access points typically have weaker controls.

These are foundational security concepts. Access control principles. Authentication mechanisms. Third-party risk management. The kind of topics covered in entry-level security certifications because they're that fundamental to cybersecurity.

Your security team probably knew all the theory. But knowing the fundamentals and implementing controls that actually work when attackers are actively trying to bypass them—that's two different things.

This isn't about blaming your team. Social engineering attacks targeting third parties are incredibly difficult to defend against. But it does highlight the gap between theoretical security knowledge and practical implementation.

You're going to rebuild your contractor access controls now. Enforce MFA everywhere. Implement verification processes that can't be socially engineered. Treat third-party access as the high-risk attack surface it actually is.

And every other organization watching this £300 million lesson should be doing the same thing. Because if it happened to M&S—a major retailer with resources and security teams—it can happen to anyone.