The IT Nerd

Beginning in early 2025, the RaaS (ransomware-as-a-service) group, DragonForce has allegedly been working with affiliates Scattered Spider to aggressively target high-profile UK retailers including Marks & Spencer, Co-op, and Harrods. 

In the Marks & Spencer incident, the affiliates reportedly used social-engineering attacks on service desks to gain initial access before unleashing DragonForce’s ransomware. By deploying this ransomware to encrypt networks, the threat actors have caused major disruptions to online orders and payment systems, and have threatened the publication of customer and employee data. 

Specops Software has recently released three analyses on the Marks & Spencer attack, each diving into distinct aspects of the incident: 

1. The Rise of Ransomware-as-a-Service (RaaS): Groups like DragonForce are operating on a franchise model, providing ransomware tools to affiliates, thereby lowering the technical barrier for launching attacks. This analysis covers DragonForce, its RaaS model, how it works, how it was used in the M&S attack, and the possible infighting that’s been occurring between DragonForce and RansomHub. 
2. Service Desk Exploitation: Scattered Spider has demonstrated how easily service desks can be manipulated, emphasizing the need for stringent verification processes. This analysis discusses Scattered Spider’s alleged role in the M&S, Co-op, and Harrods attacks, the service desk M.O. that the group seems to employ, and how organizations can defend against these attacks. 
3. Active Directory Vulnerabilities: The theft of NTDS.dit files, containing password hashes, highlights the critical importance of securing Active Directory environments. This final analysis explains the impact of service desk attacks on Active Directory data bases, as well as what organizations can do to protect their ADs.  

All of these are worth reading if you are responsible for defending your organizations from threat actors.

Weiser Memorial Hospital in Idaho this week confirmed it notified 34,249 people of a September 2024 data breach that compromised names, SSNs, government-issued ID numbers, treatments and procedures, medical diagnoses, health insurance info, and DOBs. Ransomware gang Embargo claimed responsibility for the breach in September 2024, but Weiser has not yet verified this. 

In a blog post reporting this news, Paul Bischoff, Consumer Privacy Advocate at Comparitech, wrote:

“Embargo is a ransomware gang that started claiming attacks in April 2024. The group operates a ransomware-as-a-service business in which affiliates pay Embargo to use its malware and infrastructure to launch attacks and collect ransoms.”

“Embargo has claimed 14 confirmed ransomware attacks since it began, compromising about 736,000 records. Another 10 unconfirmed claims haven’t been acknowledged by the targeted organizations.”

“Comparitech researchers logged 161 confirmed ransomware attacks on US hospitals, clinics, and other direct care providers in 2024, compromising 27.2 million records. In 2025 to date, we tracked 20 such attacks affecting nearly 1.6 million records. The average ransom across all attacks is about $1.03 million.”

“Ransomware attacks on US hospitals, clinics, and other care providers can cripple key systems and endanger the privacy and security of patients. Providers must pay a ransom or face extended downtime, data loss, and putting patients and staff at increased risk of fraud. Hospitals and clinics might have to resort to pen and paper, cancel appointments, and divert patients elsewhere until systems are restored.”

The Embargo ransomware gang is new to me. Which illustrates how fast new ransomware gangs are popping up. That’s incredibly bad for all of us as there are more threat actors out there that can do harm to organizations. What needs to happen is the conditions need to exist to make ransomware less profitable so to speak, which in turn will reduce the number of threat actors making the world a bit safer.

It is being reported that fashion luxury brand House of Dior has had a cybersecurity incident which was discovered on May 7. The incident exposed customer information. From Bleeping Computer:

A spokesperson for the firm told BleepingComputer that the incident impacts Dior Fashion and Accessories customers. Currently, cybersecurity experts are investigating the incident to determine its scope.

“The House of Dior recently discovered that an unauthorized external party accessed some of the data we hold for our Dior Fashion and Accessories customers,” stated the spokesperson.

“We immediately took steps to contain this incident. The teams at Dior, supported by leading cybersecurity experts, continue to investigate and respond to the incident.”

Dior clarified to BleepingComputer that the incident did not expose account passwords or payment card information, as these were stored in a different database that remained unaffected.

“No passwords or payment information, including bank account or payment card information, were in the database affected in the incident.”

“We are working to notify relevant regulators and customers in line with applicable law.”

Javvad Malik, lead security awareness advocate at cybersecurity company KnowBe4, commented:

“Dior’s disclosure, while prompt, employs notably measured language regarding the scope of affected data. This careful phrasing “some of the data we hold” leaves considerable ambiguity about the true extent of the compromise, which is problematic from a transparency standpoint.

While the non-exposure of payment information and credentials provides some reassurance, the compromised personal data (names, contact details, purchase history) presents substantial risk. This combination of information creates a perfect foundation for highly targeted social engineering attacks against a particularly affluent customer base. The international dimension of this breach—affecting customers across multiple jurisdictions including South Korea and China—introduces complex regulatory compliance challenges. The reports from Korean media suggesting potential notification failures are particularly concerning, as timely and comprehensive regulatory notification have been a well-established compliance requirement for years.”

The fact that a high profile company such as Dior has been pwned shows that any organization is at risk. And by extension, every organization should take steps to make sure that their exposure to risk is a close to zero as possible.

UPDATE: I received a comment from Yotam Segev, Co-founder and CEO, Cyera:

“This breach appears to stem from a failure in data classification and access controls—Dior confirmed sensitive customer data was accessed, though financial data was not compromised. That points to a lack of centralized, real-time visibility into sensitive data and inconsistent protection policies. Luxury brands are often soft targets: they operate in complex, global environments but lack full data inventories and cohesive protections across markets. With regulatory implications across China and South Korea, this breach is a clear signal that data security posture management (DSPM) must become a boardroom and budget priority.”