7 ms·
Hackers strike Harrods in latest UK cyberattack
- yakshaving_jgt 1y ago> A new cybersecurity and resilience bill will make it mandatory to report more incidents. The bill’s slow progress is frustrating security experts, according to Jamie MacColl, a senior research fellow at Rusi. However, ministers have been reluctant to impose more regulation on businesses, but having “major cybersecurity incidents is not good for economic growth,” he said. A minister's bill is less effective than a Ukrainian soldier's bullet.
- deleted 1y ago[deleted]
- swarnie 1y ago> In July, four people including a 17-year-old boy were arrested on suspicion of being involved in cyberattacks on Harrods, the Co-op, and Marks and Spencer, and were bailed pending further inquiries. Your proposal is we have a foreign army come over and start executing children? What is this Bush era nonsense.
- yakshaving_jgt 1y agoMy proposal is the Western world do more to support the Ukrainian military, defeat the Putin regime militarily, and usher in the collapse of the russian federation. You can't have state-sponsored cyber-attacks if the state sponsoring the cyber-attacks goes away. No, I am not proposing anyone start killing children. What a ridiculous misinterpretation of my words. It's the russian military who kill kids[0], and nobody should be ok with that. It's also the russian government recruiting children to commit acts of sabotage[1] abroad. [0]: https://www.politico.eu/article/former-wagner-group-commanders-azmat-uldarov-alexey-savichev-confess-murder-ukraine-civilians-including-children/ https://www.politico.eu/article/former-wagner-group-commande... [1]: https://www.justiceinfo.net/en/147402-ukraine-fsb-recruits-teenagers.html https://www.justiceinfo.net/en/147402-ukraine-fsb-recruits-t...
- phatfish 1y agoYup, I find I hard to believe kids have suddenly discovered hacking in the last two years. It's either covertly state sponsored, or outsourcing everything to India is finally showing some results.
- noir_lord 1y agoYou know more than one thing can be true at once though right? I.e.some combination of state sponsored, opportunistic script kiddies and better reporting. After the earlier attacks subsequent ones get more press as well.
- swarnie 1y agoWhat's state sponsored about a bunch of bored children putting in dummy calls to retail helpdesks? I dont see what this has to do with russia russia russia
- yakshaving_jgt 1y agoIt's literally in the article. > Although cyberattacks have become more high profile, there is little reliable data on how many attacks take place in the UK each year. Hackers are drawn from a mix of organised criminal gangs, those sponsored by state actors including Russia and China, and hacktivists with a political agenda, according to a report by the Royal United Services Institute (Rusi).
- swarnie 1y agoThat's just a general statement; nothing suggests these children are working with or acting on behalf of Russia. More likely they are spectrum'd to fuckery or pushing a political agenda.
- yakshaving_jgt 1y ago> More likely What are you basing this probability on? The UK and EU has seen a significant increase in cyber-attacks and acts of sabotage since February 2022. In some cases, evidence has been found that the attacks were orchestrated by the russian government. I suppose it's all one big coincidence?
- pixxel 1y ago[dead]
- edm0nd 1y agoHonestly, kinda. I support legalizing drone striking ransomware operators.
- isaacremuant 1y agoUnfortunately, it's become Bush-Obama-Biden-Trump era nonsense because it seems ingrained now. Add all your other "western leaders" out there who also seem to love and push for wars fought by others and not their children or themselves.
- isaacremuant 1y ago[flagged]
- yakshaving_jgt 1y agoI've spent enough nights in bomb shelters in Ukraine, and I have a medal from the Ukrainian military for my contributions. How about you?
- isaacremuant 1y agoI like how your wording doesn't actually say that you actually fought in the war as a soldier, which would only get my commiserations for being used as a pawn for the benefit of geopolitics. The partial destruction of the country is extremely sad to see but I won't support the manufacture of wars nor be impressed by bullshit bravado or war jingoism. I know what pointless violence is and don't glorify it. It never looks good. It's not a movie. It's not something to be proud of, and it depends a lot on luck.
- tokai 1y ago>1984 style war propaganda Nothing screams newspeak-like thinking than western 'pacifists' that thinks self-defense, from an enemy that explicitly wants to harm us and destroy our way of living, is somehow violent. This kind of opinions are literally killing people.
- isaacremuant 1y agoYour "they hate us for our freedoms and our way of living" is pure propaganda and doesn't work anymore. Your opinions to create wars that didn't need to happen are literally killing people. Boring stuff, really. Update the chip. Stop destroying countries.
- yakshaving_jgt 1y agoThe russian regime started the war.
- some_random 1y agoFunny you say this because Scattered Spider is largely made up of Western teenagers, not Russians.
- neffy 1y agoThere is a fair bit of grooming going on out there on the private discord channels and similar.
- ThrownOffGame 1y agoBad news, folks: the erudite hackers have added an apostrophe to Harrod's logo
- HPsquared 1y agoFor some reason the "no apostrophe" thing is common in UK company names.
- fredoralive 1y agoThe greengrocer’s have taken the entirety of the British High Streets apostrophe supply.
- marcosscriven 1y ago6 orange’s for just £3!
- FearNotDaniel 1y ago> just £3 Which is of course pronounced: JAST FREE PAAAAAARND
- celticninja 1y agoI think you will find that is JAST FREE PHAAAAAND
- teddyh 1y agoMorny stannit!
- fsckboy 1y agowe've used ours on cocktail's for happy hour
- Angostura 1y agohttps://londonist.com/2016/10/londons-dropped-apostrophes https://londonist.com/2016/10/londons-dropped-apostrophes
- swarnie 1y agoGreat, that'll be another intelligence review Monday morning. Can someone give the kids a ping pong table or something so i can eat my breakfast in peace?
- bloqs 1y agoIt's almost like they earned enough from the data that the risk was worth it
- damienwebdev 1y agoFrom a brief review, it looks like the underlying platform they use is https://www.scayle.com/ https://www.scayle.com/ (though I'm not sure its the one that was attacked) its just the one I found while looking at their site.
- eterm 1y agoFrom the article, it sounds like this was earlier in the year, but they're only revealing it now? Isn't that way beyond the deadline for such things?
- deleted 1y ago[deleted]
- akerl_ 1y agoDoes the UK actually have a mandated deadline for any kind of infosec disclosure?
- arethuza 1y agoIf the breach contains personal data then you are supposed to report it within 72 hours: https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/ https://ico.org.uk/for-organisations/report-a-breach/persona...
- eterm 1y agoWe were still in the EU when GDPR came along, and we haven't repealed our implementation of it, the Data Protection Act ( 2018 ), which has mandated disclosure in line with GDPR. Even pre-GDPR we had much stronger data protection than most countries with the Data Protection Act ( 1998 ), although I don't remember that having disclosure rules, it did have a lot of things that companies only freaked out about post GDPR and the weight of the EU behind severe penalties.
- testplzignore 1y agoTerrible tech reporting, as is the norm. https://www.bbc.com/news/articles/c8d70d912e6o https://www.bbc.com/news/articles/c8d70d912e6o indicates that the recently announced breach was separate from the one in May (for which the attackers were arrested in July?). I think the one in May leveraged CVE-2025–31324.
- eterm 1y ago
- TheSilva 1y agoJust two days ago the BBC published[1] a story about how a ransomware group tried to infiltrate their network by.... approaching their cybersecurity correspondent. I wonder if it was the same group. [1] https://www.bbc.com/news/articles/c3w5n903447o https://www.bbc.com/news/articles/c3w5n903447o
- ThrownOffGame 1y ago[flagged]
- pandemic_region 1y agoHow much time before a large bank will be held hostage by such an attack?
- observationist 1y agoIt's likely already happened, but we will never hear about it. Their attack surfaces will be clustered and broken up, through an inhomogenous distribution of various systems and layers and networks, and the entirety of the system will be protected through disjoint connections, both the intentional and the bureaucratic and structural that follow from the mere fact of being really big organizations. Any particular unit within the whole that gets pwned will have recovery tactics available, but reporting will probably be kept as private as humanly possible, even to the extent of avoiding reporting to government, so as to avoid "damage" to markets, loss of reputation, runs on the bank, and so forth. If they don't have a near instant recovery and mitigation of the attack, they'll be much more likely to pay and recover, quietly, than most other organizations. There are laws and regulations and boxes that get checked to ostensibly hold them to a high cybersecurity standard, but that's a lot of theater and pomp for public confidence over anything practical. Where they benefit is from being able to pay for teams and high quality security personnel and being incentivized to avoid getting hacked. It's not in anyone's interest to make a lot of fuss or noise in the public eye, so us chickens out here won't ever hear about anything that happens. That comes with the caveat that the big banks can afford to pay really nasty people to go find hackers and turn them over to authorities, or worse options in more lawless parts of the world, and the public will never hear about those actions either, which disincentivizes the hackers. There are easier ways of getting more money with less risk of catastrophic personal outcomes, with the technical difficulty of even attempting anything serious filtering out the impulsive and stupid.
- catlikesshrimp 1y ago"Bank runaway" and "Loss of confidence in markets" does it. That works for your country. Why aren't banks in smaller countries affected? Their security is not good, and markets aren't important. In Costa Rica there was an incident where the equivalent of the IRS was held ransom and the government didn't pay. (Thumbs up to them.) Again, why doesn't that happen to banks there?
- rich_sasha 1y agoI know very little about cyber security in the wild - little Bobby Tables is about my level. Are these hacks unavoidable, or are they indicative of shoddy IT on the victim's side? There has been a sleugh of cyberattacks recently and I don't know what to make of it. If it's kind of like getting burgled - get good home security but a determined burglar will get in anyway - then it's a systemic problem we have to somehow tackle as a society. And if it's shoddy workmanship, again, it would appear so widespread that we have to do something about it. I'm not passing judgment, just trying to understand.
- deleted 1y ago[deleted]
- Veserv 1y agoThere is no system in use by a commercial entity in the world that can stop criminals with ~10 M$ from completely bypassing all of their security and doing arbitrary amounts of damage. If the attackers can on average derive more than 10 M$ of return, then you are guaranteed profitable to hit. For instance, in the 2023 casino hacks of MGM and Caesars, Caesar paid a random of ~15 M$, making them profitable. In the JLR hack, JLR has incurred ~500 M$ of damage to date. These attacks cost less than 10 M$ to create and deploy guaranteed. However, most commercial systems are vastly easier to hit than even 10 M$. I would venture that most of these high profile attacks are on the order of merely ~10-100 K$ to actually create and deploy making them wildly profitable with a ROI in the 10-1000(!) range. And, if you have the choice of spending 100K to get 15 M$ or 10 M$ to get 15 M$, it is pretty obvious who you would prioritize. It is like the story of two people and the hungry bear. Even if you can not outrun the bear, if you can outrun the other person then the bear will tear you apart second. So it is both. Everything is shoddy. Some are dramatically more shoddy than others. And the hungry bears are breeding so they can eat all the dodos.
- SXX 1y agoNo doubt there are some professional cyber criminal groups like ones from North Korea, but I seriously doubt that most of high-profile attacks even cost $10-100k. I mean you could say that if salary of random black hat researcher from Turkey, ex-USSR or Nigeria was $100,000 / year. But they obviously have no salary whatsoever and just trying and trying until they finally find suitable target. Most likely all that was used is $50 / month server for nmap and other tools, bunch of $3 / month VPNs. Or might be everything that was needed is $10 for a eSim and one scam call. And of course a lot of time of a person who can't get properly paid job anyway. Obviously might be only few people succeed, but in the end each particular attack cost peanuts.
- Kate5477 1y ago[dead]
- Kate5477 1y ago[dead]