Four people have been arrested over suspected involvement in April's cyberattacks on Marks and Spencer Group PLC (LSE:MKS), Co-op and Harrods, the National Crime Agency (NCA) has said.
The agency said a 20-year-old female, two 19-year-old males and another aged 17 were apprehended in the West Midlands and London on Thursday morning.
They were arrested on suspicion of offences under the Computer Misuse Act, blackmail, money laundering and participating in the activities of an organised crime group, the agency said in a statement.
M&S estimated that the hack would results in around a £300 million hit to profits, as it was forced to close its online operations and saw product availability affected in stores around the country.
Reports from the BBC suggested that Marks boss Stuart Machin was directly targeted and taunted as part of the attack, with the ransomware hackers, who called themselves DragonForce, sending an abusive email from a hijacked employee account, boasting that they’d encrypted M&S’s servers and were stealing data belonging to millions of customers.
Today, having been arrested at their home addresses and had their electronic devices seized for digital forensic analysis, all four of were being kept in custody for questioning, the agency said.
"Since these attacks took place, specialist NCA cybercrime investigators have been working at pace and the investigation remains one of the agency's highest priorities," said Paul Foster, head of the NCA's cybercrime unit.
"Today's arrests are a significant step in that investigation but our work continues, alongside partners in the UK and overseas, to ensure those responsible are identified and brought to justice.
"Cyber attacks can be hugely disruptive for businesses and I'd like to thank M&S, Co-op and Harrods for their support to our investigations.
"Hopefully this signals to future victims the importance of seeking support and engaging with law enforcement as part of the reporting process. The NCA and policing are here to help."
M&S said at its May results that online sales and profits for its clothing and home products were "heavily impacted" after the group was forced to pause online shopping, though stores were said to have remained resilient.
Food sales were hit by reduced availability, with additional waste and logistics costs denting profit in the first quarter.
The FTSE 100 company said online disruption was expected to continue into July, four months after the initial attack, as operations got back up to full speed and it incurred some extra stock management costs.