The UK’s Food Supply Chain Audit Turns Retail Ransomware Into a National Preparedness Gap

Britain’s public spending watchdog has looked at what keeps food on supermarket shelves, and concluded that a government department is not ready for the day a real shock hits the system. The National Audit Office’s September 4 report on the resilience of the food supply chain does not treat cyberattacks as a hypothetical. It names names, citing “cyber-attacks on retailers in 2025, such as Marks and Spencer and Co-op” as a concrete example of the disruptions it is warning about, a case study in how quickly a single intrusion can turn into an industry-wide reliability problem.

A Watchdog Report Grounded in Real Losses

The Department for Environment, Food and Rural Affairs (Defra) has designated food as one of the United Kingdom’s 13 Critical National Infrastructure (CNI) sectors, a category reserved for systems the government considers essential to the country functioning. According to the NAO, Defra sorts the threats to that system into two buckets: “acute risks” that demand an emergency response, such as extreme weather, energy disruptions, disease outbreaks, and cyberattacks, and slower-moving “chronic risks” like climate change that erode resilience over time.

The report’s core finding is that Defra has leaned almost entirely on private industry to absorb these shocks, and that approach has worked so far mostly because it has never been seriously tested. Businesses kept food moving through COVID-19 and the disruption from the war in Ukraine without major government intervention. But the NAO says Defra “is less confident about the ability of businesses to withstand shocks without government intervention in the next five to 10 years because of increasing risks and the potential for more severe disruptions.”

Gareth Davies, head of the NAO, put it plainly in the report’s press release: “Recent disruptions have shown the resilience of the UK’s food supply chain, but risks are increasing in likelihood and severity. Defra should learn from approaches taken in other countries, and strengthen preparedness for emergencies by testing plans with local government and industry.” Notably, M&S itself is listed among the organizations the NAO consulted while researching the report, alongside other retailers like Tesco and industry bodies such as the National Farmers’ Union, giving the findings a direct line back to the company at the center of the incident.

What Went Wrong at M&S and Co-op

A Help Desk Call That Started It

The attacks the NAO cites did not begin with an exotic exploit. Investigators have linked the intrusion to Scattered Spider, a loosely organized, largely English-speaking cybercrime collective also tracked as UNC3944 or Octo Tempest, whose signature technique is social engineering rather than novel malware: calling a target’s IT help desk, impersonating an employee, and talking a support agent into resetting credentials or disabling multi-factor authentication. It is the same playbook the group used to breach MGM Resorts in 2023. Testifying before UK lawmakers in July 2025, M&S chairman Archie Norman confirmed the ransomware group DragonForce was responsible for the hack and suggested it had been collaborating with Scattered Spider. From there, the DragonForce encryptor was deployed against M&S’s VMware ESXi hosts on April 24, encrypting the virtual machines behind core systems including online ordering and contactless payment.

The operational damage was substantial. M&S suspended online clothing orders for nearly two months and click-and-collect service for close to four, while both food and clothing availability in stores took a hit. Co-op’s own systems were compromised separately but around the same time; CEO Shirine Khoury-Haq later confirmed in a BBC interview, as reported by CyberInsider, that attackers exfiltrated the personal data, names, dates of birth, email addresses, phone numbers, and home addresses, of all 6.5 million Co-op members. No financial or payment data was taken. Notably, Co-op initially described the impact as limited when it disclosed the breach on April 30, 2025, before the full scope became clear in subsequent weeks.

The Bill

M&S’s own disclosures, reported by Reuters via Insurance Journal, give a rare, precise look at what a modern ransomware attack costs a large retailer. In May 2025, the company estimated the attack would cost roughly £300 million in lost operating profit for the full year, and said it hoped to cut that roughly in half through insurance, cost control, and other mitigation. By its half-year results, M&S reported a 55.4 percent slide in underlying profit, with adjusted profit before tax falling to £184.1 million from £413.1 million a year earlier. The company had booked £101.6 million in direct cyberattack-related costs in that six-month period, nearly offset by £100 million in insurance proceeds it had received by then. The Register’s coverage of the NAO report puts M&S’s total estimated cost at around £136 million once the rest of the financial year is accounted for, a steep discount from the initial £300 million estimate but still a nine-figure hit from a single intrusion that started with one phone call.

The UK’s Cyber Monitoring Centre, an independent body that classifies major incidents, went further and treated the M&S and Co-op attacks as a “single combined cyber event,” estimating its total financial impact at somewhere between £270 million and £440 million across both companies.

Four Arrests, One Persistent Threat

There has been some accountability. In July 2025, the UK’s National Crime Agency arrested four people, aged 17 to 20, in the West Midlands and London on suspicion of Computer Misuse Act offenses, blackmail, money laundering, and participating in an organized crime group, in connection with the attacks on M&S, Co-op, and Harrods. Investigative journalist Brian Krebs later identified two of the 19-year-olds as Owen David Flowers and Thalha Jubair, with Jubair separately alleged to have been a core member of the LAPSUS$ group and an administrator of the doxxing site Doxbin. Charles Carmakal, CTO of Mandiant Consulting at Google Cloud, called the arrests “a significant win,” noting that previous arrests tied to the group had caused “a significant lull in activity” and describing the moment as “a critical window for organizations to fortify their defenses.”

Security researchers who track the group caution that a handful of arrests will not retire the underlying tactics. “While ransomware is an ever-present threat, Scattered Spider represents a persistent and capable adversary whose operations have been historically effective even against organizations with mature security programs,” Grayson North, a senior security consultant at GuidePoint Security, told The Hacker News. Carmakal pointed to the practical fix in the meantime: “organizations can take proactive steps like training their help desk staff to enforce robust identity verification processes and deploying phishing-resistant MFA to defend against these intrusions.”

Why the NAO Says Defra Isn’t Ready

The NAO’s complaint is not that Defra has ignored the risk. It is that Defra’s preparations have not kept pace with it. The department has expanded its Food Supply Chain Resilience team and increased its focus on planning for catastrophic scenarios, and it has specifically run food-sector cyber incident exercises since 2023. But the NAO found several structural gaps behind that effort:

• Defra lacks the legal powers it may need during a catastrophic event, including the power to direct businesses to take emergency action.
• The last national exercise testing preparedness for a truly catastrophic food supply disruption ran in 2023, and it largely excluded food supply chain businesses, some of which told the NAO they would welcome inclusion next time.
• Businesses had limited input into the development of Defra’s own response “playbook” for food supply disruptions, creating a risk that the plan will not survive contact with a real incident.
• Local resilience forums, the regional bodies expected to coordinate an actual emergency response, say they lack clarity from Defra on what is expected of them.
• Despite sitting on several cross-government working groups, Defra told the NAO in 2025 that it had very little confidence that cross-government resilience work was sufficiently joined up.

There is also an underlying irony The Register drew out: Defra’s own digital operations lag behind what a rapid, coordinated response would require. As of 2023, roughly two-thirds of the department’s interactions with its 21 million customers still relied on paper-based forms, and about 30 percent of its applications were out of support. A department that struggles to modernize its own systems is being asked to referee a crisis in an industry that just watched two of its members lose hundreds of millions of pounds to a single social-engineering phone call.

The NAO’s recommendations are correspondingly practical rather than dramatic: refresh how Defra engages with food supply chain businesses, use the government’s existing “CNI Knowledge Base” tool to actually map critical food infrastructure, learn from resilience approaches used in other countries and other CNI sectors, and increase the transparency of the government’s own planning assumptions so they can be tested with local government and industry before, not after, the next disruption.

The Broader Pattern

The food supply chain report lands alongside a wider UK reckoning with how loosely regulated critical infrastructure cybersecurity still is. Peers have separately questioned why the country’s own Cyber Security and Resilience Bill leaves corporate executives off the hook for personal liability, relying on a voluntary governance code rather than the kind of binding accountability the NAO’s food supply chain findings suggest is overdue. And the underlying question of what CNI status actually buys a sector is contested from the opposite direction, too: the Green Party has separately called for stripping new data centers of their own blanket CNI designation, arguing it lets server farms outrank ordinary households for water and electricity during shortages. Food’s problem is the reverse: a CNI label with no comparable teeth, sitting alongside a department that admits its own preparedness has not kept pace with the risk.

What the M&S and Co-op case demonstrates is what happens when a CNI sector is designated on paper but resourced like any other industry. The attackers did not need to breach a power grid or a water treatment plant. They needed one convincing phone call to a help desk, and the rest followed from there: encrypted servers, stolen member records, £136 million in direct costs at just one of the two companies, and a government watchdog concluding, more than a year later, that the department responsible for the sector still has not tested its own emergency plan with the businesses that would have to execute it.