British retailer Marks & Spencer believes the ransomware operation behind the April cyberattack was conducted by a group called ‘DragonForce,’ its chairman said

DragonForce has quickly climbed the threat charts, morphing from a politically driven hacktivist crew out of Malaysia to a heavyweight ransomware player targeting big names like M&S. Their pivot to extortion and ransomware has been marked by coordinated attacks on UK retailers, with data exfiltration and operational chaos as a hallmark move. The M&S breach in April shut down online sales, triggered massive financial loss, and exposed customer data—though payment info stayed safe. Forensic teams are still untangling the fallout, which has led to lawsuits and forced the company to overhaul its cyber defenses. Curious how this attack fits the new ransomware playbook? DragonForce’s expansion mirrors a wider arms race, with retail and financial sectors now prime targets for multi-vector exploits. This signals a shift: it’s not just about ransom, but brand damage and legal pain, making resilience an urgent play for every CISO watching the tape. More on the M&S attack, DragonForce ops, and the evolving ransomware market right here: