BBC correspondent Joe Tidy talks to Co-Op and M&S hackers

BBC Cyber Correspondent Joe Tidy has reported how he recently found himself in direct contact with hackers claiming responsibility for the cyber-attacks on UK retailers, M&S and Co-op.

Tidy, a veteran of cyber security reporting,  said that over a five-hour exchange, he gleaned details of the hackers’ alleged involvement in the disruptive attacks.

“It became clear to me that these apparent hackers were fluent English speakers and although they claimed to be messengers, they were obviously closely linked to – if not intimately involved in – the M&S and Co-op hacks,” he stated in a recent news article.

Tidy learned the hackers’ frustration with Co-op’s refusal to meet their ransom demands and, following consultation with the BBC’s Editorial Policy team, reported that the hackers had provided evidence of their responsibility for the hack. The Co-op, which had initially downplayed the incident, also acknowledged the significant data breach to its employees, customers, and the stock market.

According to Tidy, the hackers sent him an angry message about Co-op’s response, revealing that the retailer had narrowly avoided a more severe attack. This communication, along with other information, confirmed to him that the hackers were associated with the DragonForce hacking group.

In the article, Tidy explains DragonForce’s operations: “DragonForce offers cyber criminal affiliates various services on their darknet site in exchange for a 20% cut of any ransoms collected… Anyone can sign up and use their malicious software to scramble a victim’s data or use their darknet website for their public extortion.”

However, the identity and location of those behind DragonForce still remains unclear, even to Tidy, who received no direct answers when he inquired via Telegram. While the hackers did not confirm their affiliation with Scattered Spider, they acknowledged a Bloomberg report that suggested this connection.

In the article, Tidy describes Scattered Spider as “not really a group in the normal sense of the word,” but rather “more of a community which organises across sites like Discord, Telegram and forums.”

https://www.bbc.co.uk/news/articles/cgr5nen5gxyo