Last week, Marks & Spencer (M&S) found itself grappling with a significant cyber attack that has severely impacted its IT systems, resulting in the suspension of online sales for over a week and a substantial decrease in market value. Amid this turmoil, Tyler Buchanan, a 23-year-old British man, was extradited from Spain to the United States, where he faces multiple charges related to his involvement with the cyber criminal group Scattered Spider, which is believed to be behind the M&S breach.

Buchanan’s extradition follows a ten-month process during which he awaited legal proceedings on allegations of orchestrating cyber attacks alongside young co-conspirators. The FBI claims that Scattered Spider has targeted dozens of companies across the UK, US, Canada, and India throughout 2022, with M&S being one of the more recent victims.

According to sources, DragonForce—a hacking collective—has suggested that it, along with its affiliates, was responsible for the M&S hack and similar attacks on other retailers, including Co-op and Harrods. Notably, experts indicate that the association between DragonForce and Scattered Spider is not surprising, as they are thought to operate collaboratively to carry out extortion through ransomware.

Buchanan was arrested in July 2022 in Palma, Mallorca, about to board a flight to Naples. At the time, law enforcement discovered he had access to a cryptocurrency wallet containing over $26 million in Bitcoin. His unassuming appearance contrasted sharply with his alleged criminal activities, as he was described wearing casual attire when apprehended.

His father, Robert Buchanan, maintains that his son is not involved with Scattered Spider, though he acknowledges Tyler’s exceptional proficiency in technology, reportedly beginning at the age of six. Family representatives have described Buchanan’s role in the cyber realm as more akin to a team captain than a central leader.

Court documents reveal that Buchanan and his associates engaged in phishing schemes—strategies that involve tricking individuals into providing their access credentials via deceptive communications. The FBI further elucidates that Buchanan had registered a fake website without adequate precautions, making it relatively easy for authorities to trace him back to Dundee, Scotland. In April 2023, police recovered a substantial array of computers and devices containing sensitive information from compromised companies.

Cyber security experts note that Scattered Spider’s activities include techniques such as SIM swapping. This involves deceiving telecom employees to transfer victims’ phone numbers to new SIM cards, allowing hackers access to one-time codes for account logins. Experts highlight that attackers often employ British English to convincingly masquerade as legitimate IT support, leading potentially unsuspecting targets to divulge sensitive information.

M&S has not publicly detailed how the attack was executed or what ransom demands were made, but historical precedents suggest that such cyber extortion often involves substantial financial demands. Microsoft has identified Scattered Spider as one of the pervading threats in the cybercrime landscape, linking it to notable incidents including a significant breach at MGM Resorts International in September 2023, which resulted in considerable operational disruption and financial loss.

A troubling trend linked to Scattered Spider is its association with a broader, darker community known as The Com, which reportedly manipulates vulnerable youths into participating in criminal activities. The UK’s National Crime Agency has expressed concern over minors being enticed to engage in malicious behaviour by more experienced cybercriminals within these circles.

Recent reports indicate that attackers associated with Scattered Spider have resorted to extreme intimidation tactics, involving threats of violence to extort sensitive information. These alarming behaviours suggest a culture where young hackers vie for reputation and success within the community, leading to inter-group rivalries and competitive aggression.

Buchanan remains in federal custody in California and is expected to appear in court later this month. His lawyer has asserted his entitlement to the presumption of innocence, characterising him as a well-intentioned individual rather than a key player in a sophisticated criminal enterprise. The nature of the M&S attack remains under investigation, with cyber security experts from CrowdStrike, the National Cyber Security Centre, GCHQ, and law enforcement agencies involved in the ongoing response efforts to mitigate the damage.

Experts emphasize the importance of vigilance among retailers and corporations, advocating for enhanced security measures to protect against such disruptive cyber threats in an increasingly digital environment.

Source: Noah Wire Services