Key points
- Hackers used “social engineering” to breach M&S
- TCS denies fault, claims breach in M&S environment
- M&S began seeking new helpdesk provider pre-attack
ISLAMABAD: Marks & Spencer has ended its long-standing contract with Tata Consultancy Services (TCS) to manage its technology helpdesk, following a devastating cyber attack earlier this year. The retailer, which lost an estimated £300m from the breach, cancelled the deal in July, just months after hackers forced it to halt online sales for weeks, leaving shelves empty.
The Indian IT giant denied any responsibility for the breach, but the termination of the contract shortly after the attack raises questions about its involvement. Hackers, identified as Scattered Spider, reportedly used “social engineering” tactics, impersonating executives through helpdesk calls to reset passwords and gain access to M&S’s systems, according to Financial Times.
In July, M&S chairman Archie Norman explained that the hackers had used “sophisticated impersonation” involving a third party. TCS conducted an internal investigation and found no fault with its helpdesk. However, Liam Byrne, chair of the business select committee, wrote to TCS for clarification. TCS responded that the breach occurred within M&S’s own environment, not its network.
Major IT contractor
TCS, a major IT contractor for UK businesses, continues to work with M&S on other technology projects, including its data centre and cloud services. However, concerns have been raised about the risks of outsourcing critical IT functions to companies like TCS, especially with helpdesks where operators may make human errors.
M&S had already started the process of finding a new helpdesk provider in January, before the cyber attack occurred. A spokesperson for M&S stated that the decision was part of a routine process and “has no bearing on our wider TCS relationship,” adding that the change was unrelated to the cyber incident.
TCS emphasised that it does not provide M&S’s cybersecurity services, which are handled by another partner.
