Harrods attempted cyber intrusion

Same cluster (attack attempted, contained faster). Limited disruption vs. M&S/Co-op due to faster isolation of systems.

Last modified

Summary

  • Environment: Luxury retail
  • Operational impact: Limited disruption vs. M&S/Co-op due to faster isolation of systems
  • Financial impact: No financial figure is established by the reviewed source evidence
  • Record status: Developing record. Reviewed September 19, 2026; updated as evidence emerges.

What happened

In 2025, Harrods experienced an incident in its luxury retail environment. The retained source describes the attack path as follows: Same cluster (attack attempted, contained faster). [1]

The documented consequence was: Limited disruption vs. M&S/Co-op due to faster isolation of systems. [1]

Impact

  • Documented impact: Limited disruption vs. M&S/Co-op due to faster isolation of systems. [1]
  • No financial loss, ransom amount, recovery cost, or regulatory penalty is established by the reviewed source evidence.

Timeline

  1. Documented public update

    The Harrods is the next UK retailer targeted in a cyberattack records the incident facts used in this briefing.

    [1]
  2. Briefing updated

    This briefing was last reviewed and updated on September 19, 2026.

Threat Group & Attack Vector

The retained source describes the attack path as follows: Same cluster (attack attempted, contained faster). The canonical record does not add intrusion steps beyond those supported by the source. [1]

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

  • No specific MITRE ATT&CK technique is currently mapped for this case.

Response

The reviewed source does not describe containment, notification, or restoration steps in enough detail to summarize them responsibly.

This account is bounded to Harrods is the next UK retailer targeted in a cyberattack. Details absent from that evidence are left unresolved rather than inferred. [1]