Welcome to Friendica.Eskimo.Com
Home of Censorship Free Hosting

E-mail, Web Hosting, Linux Shell Accounts terminal or full remote desktops.
Sign Up For A Free Trial Here
Please tell your friends about federated social media site that speaks several fediverse protocols thus serving as a hub uniting them, hubzilla.eskimo.com, also check out friendica.eskimo.com, federated macroblogging social media site, mastodon.eskimo.com a federated microblogging site, and yacy.eskimo.com an uncensored federated search engine. All Free!
Bill Melugin
@BillMelugin_
EXCLUSIVE: Per federal sources, the vice mayor of Cudahy, a city in southeast LA County, is under FBI investigation after she allegedly posted a video to social media in which she appears to call for 18th Street & Florencia 13 gang members in LA to defend their territory from ICE, even urging gang leadership to âget your fucking members in orderâ. âŹïž
x.com/BillMelugin_/status/1937âŠ
Russia Bleeds Past 1 Million Casualtiesâand Keeps Going, NATO Says
Russia Bleeds Past 1Â Million Casualtiesâand Keeps Going, NATO Says
According to NATO, Russia has reached a casualty rate of over one million in its war against Ukraine, indicating a continued high tolerance for losses.Ivan Khomenko (UNITED24 Media)
about how theyâll react
when you tell them
youâre uncomfortable going out
because the virus is surging,
just tell them
that itâs too damn hot to go out,
better to blame the thermometer
outside your home
than to need to put a thermometer
inside your mouth.
Israel has been exposed as a dependent colony that relies on the West for its military adventures. And even still, it has failed to turn this advantage over Iran into strategic success. The Israel doctrine appears to be meeting its limits.
It's no surprise that Stephen Miller owns a large stake in Palantir, but it's not just about getting rich - the Trump administration marks a coming together a Tech-Right authoritarians and neo-fascists who want ethnic-cleansing.
We mapped out these ideologies here: itsgoingdown.org/good-night-teâŠ
Good Night, Tech-Right: Pull the Plug on AI Fascism
On January 20th, at a ceremony attended by both far-Right and neo-fascist leaders from around the globe and some of the richest tech billionaires in the world, including the heads of Apple, Google,...It's Going Down
EV-Carrying Ship Sinks In Pacific Ocean After Catching Fire - Slashdot
An anonymous reader quotes a report from Transport Topics: A ship that caught fire in the Pacific Ocean earlier this month has sunk. The vessel was abandoned in the middle of the pacific -- about 360 miles from land -- after a blaze.tech.slashdot.org
NEW: "If ICE is holding 59,000 immigrants in civil detention across the country, it would be the highest number on record that I'm aware of," said Austin Kocher, a professor at Syracuse University who studies the U.S. immigration system.
cbsnews.com/news/ice-record-59âŠ
ICE holding a record 59,000 immigrant detainees, nearly half with no criminal record, internal data show
U.S. Immigration and Customs Enforcement is holding around 59,000 detainees in facilities across the country, likely setting a record high, according to internal government data obtained by CBS News.Camilo Montoya-Galvez (CBS News)
XBOW, an autonomous penetration tester, has reached the top spot on HackerOne
Link: xbow.com/blog/top-1-how-xbow-dâŠ
Discussion: news.ycombinator.com/item?id=4âŠ
XBOW â The road to Top 1: How XBOW did it
For the first time in bug bounty history, an autonomous penetration tester has reached the top spot on the US leaderboard.xbow.com
A Manufactured Crisis: Myth Of Russian Threat To Europe
DEAR FRIENDS. IF YOU LIKE THIS TYPE OF CONTENT, SUPPORT SOUTHFRONT WORK :Odysee
Ădifice bien connu, le long du Canal Lachine
Réjean Leroux 2025
Photo du 29-07-2018 â #mywork, #myphoto, #photo, #photographie, #photography, #foto #amateur, #couleur, #gimp, #MontrĂ©al, #architecture
like this
messidor_, yvad, Indiefotog, Nudist Awareness, dieter_wilhelm, Damien Tron, Miguela and Kristian like this.
Pacomm reshared this.
Sensitive content
The headline included "influencer" which I generally could care less about. Clicked anyway--and aw, shit. Too fucking soon. What a lovely human she was. Goddammit. There's SO many other people that SHOULD be dead. Not her.
the-independent.com/life-styleâŠ
Mikayla Raines death: Save a Fox YouTube star dies, aged 29
Wildlife rescuer has been remembered as a âsuperheroâ who saved hundreds of animalsEllie Muir (The Independent)
Sensitive content
Bullied to death??
Fucking hell.
my gut feeling is without an assessment on site nobody can say for sure whether these facilities were destroyed or damaged and to what extent.
3x MOP bombs, with the ability to penetrate 18 meters of reinforced concrete, in close to the same location in succession, vs 90m of rock, dirt and some amount of reinforced concrete above the facility.
i think it depends a lot on the composition and stability of the rock above the facility and how reinforced the structure was, and how well timed the blasts were, the angle and some other variables.
you need someone on the ground to assess the extent of the damage, so i call BS on the CNN report and also on trump's claim that it was totally obliterated, until someone has proof one way or another.
Palestinian Sisters-Intifada
Things were winding down and then these Palestinian sisters started up with the megaphones, drummers joined
in, it was rocking... They kept it going for about 20 mins I captured seven minutes before my battery cut out...
#StopBombingIran
#Protest
#USEmbassy
#London
tube.nogafa.org/w/1uEuo9KcYUWfâŠ
like this
clarice overhere, Sunyata âž đšđ»đ» âź, thierry 3b2, dieter_wilhelm and hummingbird like this.
nowisthetime reshared this.
Lyon abandonne Microsoft office pour renforcer sa « souveraineté numérique » - Next
La Ville de Lyon va progressivement remplacer la suite Microsoft par des logiciels bureautiques libres, dont « Only Office pour la bureautique, ainsi que Linux et PostgreSQL pour les systÚmes et bases de données ».
next.ink/brief_article/lyon-abâŠLyon abandonne Microsoft office pour renforcer sa « souverainetĂ© numĂ©rique » - Next
La Ville de Lyon va progressivement remplacer la suite Microsoft par des logiciels bureautiques libres, dont « Only Office pour la bureautique, ainsi que Linux et PostgreSQL pour les systÚmes et bases de données ».Next
like this
redj 18, Anne, qlod and Laurent Espitallier like this.
the art of life is not to let the doors that have slammed shut
distract us from the doors that have just opened
Lost in Translation: Will der Iran wirklich Israel auslöschen?
Iran und Israel verbindet eine tiefe Feindschaft. Doch stimmt das Narrativ der Vernichtungsdrohung? Eine Analyse zeigt: Ăbersetzungsfehler spielen eine wichtige Rolle.Luca SchĂ€fer (heise online)
Sensitive content
U.S. Joins War On Iran
DEAR FRIENDS. IF YOU LIKE THIS TYPE OF CONTENT, SUPPORT SOUTHFRONT WORK :Odysee
foxnews.com/opinion/gregg-jarrâŠ
static-assets-1.truthsocial.coâŠ
GREGG JARRETT: Trump's deployment of National Guard is justified despite knee-jerk judicial roadblock
We're in the middle of a legal power struggle between Trump and California Gov. Newsom as judge blocks deployment of National Guard troops sent to quell anti-ICE riots in Los Angeles.Gregg Jarrett (Fox News)
Fight the Proscription of Palestine Action
crowdjustice.com/case/palestinâŠ
Palestine Action has instructed lawyers who will fight against the Home Secretary's attempt to ban our movement.
Contribute to the legal fundraiser to help us stop the proscription.
Fight the Proscription of Palestine Action
A direct action network crowdfunding to fight proscriptionCrowdJustice
usatoday.com/story/money/food/⊠via @usatoday
Kraft Heinz, General Mills to remove all artificial dyes from food products
Kraft Heinz and General Mills announced Tuesday that they plan to remove artificial dyes from their food products by the end of 2027.Mary Walrath-Holdridge (USA TODAY)
the heiress of the Heinz company married John Kerry the democrat bigwig
Blog post on the topic: Broken Fediverse
battlepenguin.com/tech/the-broâŠ
written by @djsumdog
Good summary of the situation. Also glad that he mentioned alternatives like Nostr
The Broken Fediverse
When Elon Musk originally bought Twitter, a number of people moved over to Mastodon. There were a lot of misunderstandings around how Mastodon works....battlepenguin.com
xianc78 reshared this.
đ€đ» from the nostrverse
Do you have a npub / nostr profile as well?
Yes
npub1hrjtmuryqz82hxzpvv5ulrcxxgrw42afax8n7d9cnnz0zrrq44tqpv3ft3
UK activists punished for destroying Israeli weapons facilities, with Huda Ammori and Max Geller
youtu.be/odphRht6aok?si=hTY4G6âŠ
#ElectronicIntifada #PalestineAction #HudaAmmori #MaxGeller #Palestine #DirectAction #activism
UK activists punished for destroying Israeli weapons facilities, with Huda Ammori and Max Geller
We speak to to returning guests Huda Ammori and Max Geller from Palestine Action.Actionists, as members of the direct action group call themselves, deliberat...YouTube
Gary Hill likes this.
Actionists released after they shut down Shenstone's Israeli weapons factory â all in a day's work
Source: https://x.com/Pal_action/status/1862245804343230812
Gary Hill likes this.
Interview with Israeli dissidents taking action for Palestine
youtu.be/y3Ga4DiV7eM?si=u83-0râŠ
#PalestineAction #activism #Palestine
Interview with Israeli dissidents taking action for Palestine
To mark a year of genocide in Gaza, we publish this powerful interview with two Israeli dissidents who took part in a Palestine Action siege of the Elbit HQ....YouTube
Gary Hill likes this.
they are not really concerned about Iranian sleeper cells
it is just another fear bomb they throw into society to destabilize it, the communist pathway to power
Palestine Action keeps winning
presstv.ir/Detail/2024/12/21/7âŠ
#PalestineAction #activism #Palestine
Palestine Action keeps winning
In todayâs show, weâll be exploring how Palestine Actionâs activities have struck another costly blow against the Israeli arms manufacturer, Elbit Systems.PressTV
Gary Hill likes this.
BREAKING: Palestine Action Scotland destroyed the electricity supply to Leonardo's Edinburgh weapons factory, disrupting the production of laser targeting systems for Israel's F-35 fighter jets.
Source: Pal_action on x/twitter
Gary Hill likes this.
After an action and subsequent correspondence, Hinks Haulage will refuse to take work from Israel's biggest weapons producer and Howmet Aerospace, suppliers of F-35 fighter jet parts.After their quick response to our campaign, they are now no longer a target.
--- Pal_action on x/twitter
Gary Hill likes this.
Huda Ammori | Free Political Prisoners | 20 September 2024
youtu.be/mJLldwhc3A4?si=baZlwoâŠ
Huda Ammori | Free Political Prisoners | 20 September 2024 | Defend Our Juries
Juries are a microcosm of democracy. Permitted to hear the evidence, they regularly acquit those who act to protect life. Oil and arms industry lobbyists are...YouTube
Gary Hill likes this.
Clerk: Moldable Live Programming for Clojure
Clerk takes a Clojure namespace and turns it into a notebook.clerk.vision
An IT security guy at a place I once worked said the executives were the biggest security vulnerability the company had because they wanted what they wanted and didn't care much about security. I think that's what tool Maersk down a few years ago - some exec installed malware that spread to the entire network.
"they normally put big all caps bold red warning if the person is a VIP, eg C suite, so they get VIP service - ie anything goes."
Okay, why is every right winger allowed to criticize Israel all of a sudden?đđ»
Star Of Remphan Or Seal Of Solomon?
Alex Jones Reveals The True Origin Of Modern Israel's So-Called Star Of David
Not sure. It certainly was not acceptable to criticize them a few years ago.
If I remember correctly, Alex Jones tip toed around the Israel issue for about a decade. I have seen earlier videos where he had criticisms.
Mohammad Marandi on Western Propaganda
youtu.be/AzrFiLo4y6A?si=CsrSPqâŠ
#MohammadMarandi #propaganda #WesternMedia #Iran
From Truth to Propaganda: Mohammad Marandi Accuses Democracy Now of Echoing U.S.-Israel Agenda
As tensions escalate between Israel and Iran, Iranian analyst Mohammad Marandi exposes how Western media â even so-called progressive outlets like Democracy ...YouTube
Abdul-Salam praises great sacrifices made by Iran's leadership in deterring "Israel"
SANAA, June 24 (YPA) - Head of the Sanaa negotiating delegation, Mohammed Abdul-Salam, praised the great stance and sacrifices made by Iran's leadership, people, and army during the 12-day war with the Israeli enemy.In a post on X, he emphasized thatۧŰŰłÙ (Yemen Press Agency)
UPDATE: NARA has taken this down/rescinded, and stated that it had "many inaccuracies."
This is NOT GOOD. #archives "
Restricted-Access Federal Facility, Effective July 7, 2025
Effective July 7, 2025, the National Archives at College Park, MD, will become a restricted-access federal facility with access only for visitors with a legitimate business need. It will no longer be open to the general public." archives.gov/college-park
The National Archives at College Park, Maryland
We hold permanent records created by Federal agencies that include: Textual records from civilian agencies Army unit records dating from WW1 Navy unit records dating from WW2 Still pictures Electronic records Cartographic and architectural holdings âŠThe National Archives at College Park, Maryland
forbidden secrets of ancient X11 scaling technology revealed
People keep telling me that X11 doesnât support DPI scaling, or fractional scaling, or multiple monitors, or something. Thereâs nothing you can do to make it work. I find this surprising. Why doesnât it work? I figure the best way to find out is try the impossible and see how far we get.
Iâm just going to draw a two inch circle on the screen. This screen, that screen, any screen, the circle should always be two inches. Perhaps not the most exciting task, but I figure itâs isomorphic to any other scaling challenge. Just imagine itâs the letter o or a button we wish to draw at a certain size.
I have gathered around me a few screens of different sizes and resolutions. My laptop screen, and then a bit to the right a desktop monitor, and then somewhere over that way a nice big TV. Specifically:
$ xrandr | grep \ connected
eDP connected primary 2880x1800+0+0 (normal left inverted right x axis y axis) 302mm x 189mm
DisplayPort-0 connected 2560x1440+2880+0 (normal left inverted right x axis y axis) 590mm x 334mm
DisplayPort-1 connected 3840x2160+5440+0 (normal left inverted right x axis y axis) 1600mm x 900mm
I think I just spoiled the ending, but here we go anyway.
Iâm going to draw the circle with OpenGL, using a simple shader and OBT. Thereâs a bunch of not very exciting code to create a window and a GLX context, but eventually weâre going to be looking at the shader. This may not be the best way to draw a circle, but itâs my way. For reference, the full code is in circle.c.
<span class=tp>void</span> main<span class=st>(</span><span class=st>)</span>
<span class=st>{</span>
float thick <span class=op>=</span> radius <span class=op>/</span> <span class=nm>10</span>;
<span class=kw>if</span> <span class=kw>(</span>abs<span class=cm>(</span>center<span class=op>.</span>y <span class=op>-</span> gl_FragCoord<span class=op>.</span>y<span class=cm>)</span> <span class=op><</span> thick<span class=op>/</span><span class=nm>2</span><span class=kw>)</span>
thick <span class=op>=</span> <span class=nm>2</span>;
float pi <span class=op>=</span> <span class=nm>3</span><span class=op>.</span><span class=nm>14159</span>;
float d <span class=op>=</span> distance<span class=kw>(</span>gl_FragCoord<span class=op>.</span>xy<span class=op>,</span> center<span class=kw>)</span>;
float angle <span class=op>=</span> atan<span class=kw>(</span>gl_FragCoord<span class=op>.</span>y <span class=op>-</span> center<span class=op>.</span>y<span class=op>,</span> gl_FragCoord<span class=op>.</span>x <span class=op>-</span> center<span class=op>.</span>x<span class=kw>)</span>;
angle <span class=op>/=</span> <span class=nm>2</span> <span class=op>*</span> pi;
angle <span class=op>+=</span> <span class=nm>0</span><span class=op>.</span><span class=nm>5</span>;
angle <span class=op>+=</span> <span class=nm>0</span><span class=op>.</span><span class=nm>25</span>;
<span class=kw>if</span> <span class=kw>(</span>angle <span class=op>></span> <span class=nm>1</span><span class=op>.</span><span class=nm>0</span><span class=kw>)</span> angle <span class=op>-=</span> <span class=nm>1</span><span class=op>.</span><span class=nm>0</span>;
float amt <span class=op>=</span> <span class=kw>(</span>thick <span class=op>-</span> abs<span class=cm>(</span>d <span class=op>-</span> radius<span class=cm>)</span><span class=kw>)</span> <span class=op>/</span> thick;
<span class=kw>if</span> <span class=kw>(</span>d <span class=op><</span> radius <span class=op>+</span> thick && d <span class=op>></span> radius <span class=op>-</span> thick<span class=kw>)</span>
fragment <span class=op>=</span> vec4<span class=kw>(</span>rgb<span class=cm>(</span>angle<span class=cm>)</span><span class=op>*</span>amt<span class=op>,</span> <span class=nm>1</span><span class=op>.</span><span class=nm>0</span><span class=kw>)</span>;
<span class=kw>else</span>
discard;
<span class=st>}</span>
I got a little carried away and made a pretty color wheel instead of a flat circle.
The key variable is radius
which tells us how many pixels from the center the circle should be. But where does the shader get this from?
glUniform1f(0, radius);
Okay, but seriously. We listen for configure events. This is the X server telling us our window has been moved or resized. Something has changed, so we should figure out where we are and adjust accordingly.
<span class=kw>case</span> ConfigureNotify<span class=op>:</span>
<span class=st>{</span>
XConfigureEvent <span class=op>*</span>xev <span class=op>=</span> <span class=kw>(</span><span class=tp>void</span> <span class=op>*</span><span class=kw>)</span>&ev;
<span class=tp>int</span> x <span class=op>=</span> xev<span class=op>-></span>x;
<span class=kw>for</span> <span class=kw>(</span><span class=tp>int</span> i <span class=op>=</span> <span class=nm>0</span>; i <span class=op><</span> <span class=nm>16</span>; i<span class=op>++</span><span class=kw>)</span> <span class=kw>{</span>
<span class=kw>if</span> <span class=cm>(</span>x <span class=op>>=</span> screen_x<span class=bi>[</span>i<span class=bi>]</span> && x <span class=op>-</span> screen_x<span class=bi>[</span>i<span class=bi>]</span> <span class=op><</span> screen_w<span class=bi>[</span>i<span class=bi>]</span><span class=cm>)</span> <span class=cm>{</span>
float r <span class=op>=</span> screen_w<span class=bi>[</span>i<span class=bi>]</span> <span class=op>/</span> screen_mm<span class=bi>[</span>i<span class=bi>]</span> <span class=op>*</span> <span class=nm>25</span><span class=op>.</span><span class=nm>4</span>;
<span class=kw>if</span> <span class=bi>(</span>r <span class=op>!=</span> radius<span class=bi>)</span> <span class=bi>{</span>
radius <span class=op>=</span> r;
<span class=bi>}</span>
<span class=kw>break</span>;
<span class=cm>}</span>
<span class=kw>}</span>
width <span class=op>=</span> xev<span class=op>-></span>width;
height <span class=op>=</span> xev<span class=op>-></span>height;
<span class=st>}</span>
Getting closer. The numbers we need come from the X server.
XRRScreenResources <span class=op>*</span>res <span class=op>=</span> XRRGetScreenResourcesCurrent<span class=st>(</span>disp<span class=op>,</span> root<span class=st>)</span>;
float screen_mm<span class=st>[</span><span class=nm>16</span><span class=st>]</span> <span class=op>=</span> <span class=st>{</span> <span class=nm>0</span> <span class=st>}</span>;
float screen_w<span class=st>[</span><span class=nm>16</span><span class=st>]</span> <span class=op>=</span> <span class=st>{</span> <span class=nm>0</span> <span class=st>}</span>;
float screen_x<span class=st>[</span><span class=nm>16</span><span class=st>]</span> <span class=op>=</span> <span class=st>{</span> <span class=nm>0</span> <span class=st>}</span>;
<span class=tp>int</span> j <span class=op>=</span> <span class=nm>0</span>;
<span class=kw>for</span> <span class=st>(</span><span class=tp>int</span> i <span class=op>=</span> <span class=nm>0</span>; i <span class=op><</span> res<span class=op>-></span>noutput; i<span class=op>++</span><span class=st>)</span> <span class=st>{</span>
XRROutputInfo <span class=op>*</span>info <span class=op>=</span> XRRGetOutputInfo<span class=kw>(</span>disp<span class=op>,</span> res<span class=op>,</span> res<span class=op>-></span>outputs<span class=cm>[</span>i<span class=cm>]</span><span class=kw>)</span>;
screen_mm<span class=kw>[</span>j<span class=op>++</span><span class=kw>]</span> <span class=op>=</span> info<span class=op>-></span>mm_width;
<span class=st>}</span>
j <span class=op>=</span> <span class=nm>0</span>;
<span class=kw>for</span> <span class=st>(</span><span class=tp>int</span> i <span class=op>=</span> <span class=nm>0</span>; i <span class=op><</span> res<span class=op>-></span>ncrtc; i<span class=op>++</span><span class=st>)</span> <span class=st>{</span>
XRRCrtcInfo <span class=op>*</span>info <span class=op>=</span> XRRGetCrtcInfo<span class=kw>(</span>disp<span class=op>,</span> res<span class=op>,</span> res<span class=op>-></span>crtcs<span class=cm>[</span>i<span class=cm>]</span><span class=kw>)</span>;
screen_w<span class=kw>[</span>j<span class=kw>]</span> <span class=op>=</span> info<span class=op>-></span>width;
screen_x<span class=kw>[</span>j<span class=op>++</span><span class=kw>]</span> <span class=op>=</span> info<span class=op>-></span>x;
<span class=st>}</span>
Itâs somewhat annoying that physical width and virtual width are in different structures, and we have to put the puzzle back together, but there it is.
Some more code to handle expose events, the draw loop, etc., and thatâs it. A beautiful circle sized just right. Drag it over onto the next monitor, and it changes size. Or rather, it maintains its size. Send it over to the next monitor, and same as before.
Time for the visual proof. A nice pretty circle on my laptop. Another circle on my monitor. And despite the 4K resolution, a somewhat pixely circle on my TV. Turns out the hardest part of this adventure was trying to hold an uncooperative tape measure in place with one hand while trying to get a decent, or not, photo with the other.
We were so close to perfection. Somebody at the factory screwed up, and my TV is actually 66.5â wide, not the claimed 63 inches. So if we learn anything today, itâs that you shouldnât use a consumer LG TV for accurately measuring the scale of structural engineering diagrams, at least not without further calibration.
The good news is weâve done the impossible. Even better, I didnât mention that I wasnât actually running this program on my laptop. It was running on my router in another room, but everything worked as if by MIT-MAGIC-COOKIE-1. Alas, we are still no closer to understanding why people say this is impossible.
Anyway, I think the point is we should probably ignore the people who canât do something when they tell us we canât do it either. I woke up this morning not knowing precisely how to draw a scaled circle, having never done so before, but armed with a vague sense that surely it must be possible, because come on of course it is, I got it working. And now look at me, driven insane by the relentless stare of three unblinking eyes.
With my new knowledge, I also wrote an onscreen ruler using the shape extension. Somewhat tautological for measuring the two inch circle, but in the event anyone asks, I can now tell them my terminal line height is 1/8â, and yes, I measured.
Forbidden secrets of ancient X11 scaling technology revealed
Link: flak.tedunangst.com/post/forbiâŠ
Discussion: news.ycombinator.com/item?id=4âŠ
DragonForce Ransomware Cartel are claiming credit for attacks on Marks and Spencer, Co-op and Harrods and say more victim orgs are coming bloomberg.com/news/articles/20âŠ
M&S Cyber Attack: âDragonForceâ Hacking Gang Takes Credit for UK Retail Attacks
The UK supermarket chain Co-op said hackers were able to access and extract customer data from one of its systems during a recent cyberattack.Ryan Gallagher (Bloomberg)
I'm going to make this the new ongoing megathread for DragonForce Ransomware Cartel's attack on UK retailers as they're all connected.
Why it matters: these are some of the UK's largest retailers, think Target or some such in a US sense.
Prior threads
M&S: cyberplace.social/@GossiTheDogâŠ
Co-op: cyberplace.social/@GossiTheDogâŠ
Harrods:
cyberplace.social/@GossiTheDogâŠ
Kevin Beaumont (@GossiTheDog@cyberplace.social)
Attached: 1 image Co-op Group have shut down some systems due to a cyber incident, however retail stores are still trading uninterrupted (which is core to their business).Cyberplace
The individuals operating under the DragonForce banner are using social engineering for entry.
Defenders should urgently make sure they have read the CISA briefs on Scattered Spider and LAPSUS$ as it's a repeat of the 2022-2023 activity.
Links: cisa.gov/sites/default/files/2âŠ
cisa.gov/sites/default/files/2âŠ
I would also suggest these NCSC guides on incident management: ncsc.gov.uk/collection/incidenâŠ
and effective cyber crisis comms: ncsc.gov.uk/guidance/effectiveâŠ
Co-op Group have now admitted a significant amount of member (customer) information has been stolen by DragonForce Ransomware Cartel, saying they "accessed data relating to a significant number of our current and past members" - around 20 million people. The Membership database, basically. That includes home addresses and phone numbers etc.
Up until now Co-op hadn't even used the words cyber or threat actor, referring to an "IT issue" and "third party" in comms.
bbc.co.uk/news/articles/crkx3vâŠ
Co-op DragonForce cyber attack includes customer data, firm admits
The firm previously said there was "no evidence that customer data was compromised".Joe Tidy (BBC News)
for someone who is unfamiliar with the UK retail market, do you happen to know if Co-op is at all related to the Swedish company Coop that suffered from a major ransomware attack a couple of years ago?
bbc.com/news/technology-577075âŠ
Swedish Coop supermarkets shut due to US ransomware cyber-attack
Some 500 stores are forced to close due to the ripple effects of a major cyber attack in the US.Joe Tidy (BBC News)
New by me - breaking down the attacks on UK highstreet retailers
doublepulsar.com/dragonforce-râŠ
DragonForce Ransomware Cartel attacks on UK high street retailers: walking in the front door
The individuals operating under the DragonForce banner and attacking UK high street retailers are using social engineering for entry. I think itâs in the public interest to break down what isâŠKevin Beaumont (DoublePulsar)
Regarding IOCs around the UK retailer activity - thereâs loads doing the rounds, and theyâre almost all not useful.
Eg hundreds of dynamic VPN IPs from 2022. If you google them youâll find them on vendor blogs from years ago for Scattered Spider - people are recycling in panic and passing around in panic.
Donât hunt on random IOCs. IP addresses change. Strengthen foundational controls. Review sign in logs for abnormal activity etc.
Orgs need to review their password reset process, share awareness to individuals who conduct password reset requests (IT helpdesk).
No IOC will help you identify social engineering activity.

UK cyber security at private firms tends to be very poor on average but social engineering remains the hacker's most effective tool.
Slack and Teams access in particular seems like a large attack vector. I believe the Twitter hack a few years back - when it was Twitter - was facillitated by superuser creds being pinned to a slack channel.
One of M&Sâ biggest suppliers have said they have reverted to pen and paper for orders due to M&S lacking IT.
Additionally, M&S staff are raising concern about how they will be paid due to lack of IT systems.
M&S are over a week into a ransomware incident and still donât have their online store working.
bbc.com/news/articles/cvgnyplvâŠ
M&S supplier back to pen and paper after cyber attack
What's going on behind the scenes in the aftermath of the cyber attack on M&S.Emma Simpson (BBC News)
Rebuilding business is prioritised by importance. If the online shop is a small side hustle compared to the brick&mortar ones (or is much slower), then itâs lower priority.
Communicating the current status and expected progress is better, builds trust.
Wages usually are handled as lump payment, i.e. the same sum as last mont - and corrected later when the HR systems are back online.
The incidence response team should cover IT forensics, BCM and communication.
Mr. Rumbold is sure going to be busyâŠ
Here's the ITV News report anyhoo, logline: "ITV News understands the the ongoing cyberattack faced by the supermarket has worsened since Friday, impacting the ordering system, drivers and warehouse staff."
Sunday Times has a piece looking into ransomware incident at Marks and Spencer. It's pretty good, goes into their contain and eradicate focus.
"By shutting down parts of the IT estate, Highamâs team had worked to prevent the attack from spreading, but had also stopped parts of its digital operations from functioning. This was considered a worthy trade-off."
One error in the article - lack of recovery doesn't mean no ransomware paid. Paying is not quick restoration.
Icare4America reshared this.
Big Game Ransomware: the myths experts tell board members
Thereâs a piece in The Sunday Times today about the DragonForce ransomware incident at Marks and Spencer which caught my eye. Itâs a great piece, e.g. it looks at M&S containing the threat toâŠKevin Beaumont (DoublePulsar)
Great NCSC piece by @ollie_whitehouse
Iâd add - block by Entra policy specifically High risk logins (below is too FP prone), and SOC monitor them. SOC playbook = account probably compromised. How?
Sky News quote a source in M&S head office saying Marks and Spencer have no ransomware incident plan so they are making it up as they go along apparently, with staff sleeping in the office and communicating via WhatsApp.
M&S dispute this, saying they have robust business continuity plans.
news.sky.com/story/amp/mands-hâŠ
M&S 'had no plan' for cyber attacks, insider claims, with 'staff left sleeping in the office amid paranoia and chaos'
A source describes chaotic scenes - as hackers continue to hold the High Street company to ransom.Tom Cheshire (Sky News)
Beware phony IT calls after Co-op and M&S hacks, says UK cyber centre
The NCSC urges firms to check IT help desk "password reset processes" as hackers target retailers.Joe Tidy (BBC News)
Co-op Group appear to be trying to course correct with their cyber incident comms.
Theyâre calling it a cyber incident now, and have put a statement on the front page of their website, along with an FAQ. They havenât yet emailed members (they should). Edit: theyâve started emailing members.
Co-op shops stop taking card payments amid cyber attack
Stores display handmade signs to warn customers they can only pay in cash after hackers hit retailerDaniel Woolfson (The Telegraph)
Co-op Group are redirecting supplies from their urban stores to remote and island locations due to stock shortages.
The article mentions their EDI platform is suffering âtechnical issuesâ. retailgazette.co.uk/blog/2025/âŠ
Co-op reroutes stock to rural stores amid cyber attack disruptions - Retail Gazette
The Co-op is redirecting food and drink supplies to stores in rural and remote areas in a bid to protect isolated communities from shortages following a serious cyber attack.Georgia Wright (Retail Gazette)
I just did a Shodan Safari on Co-op - basically all their Windows and Linux systems in their core DCs at network boundary are down, it's not just EDI. It's been like that for just under a week, prior to that things were still online.
I feel really bad for them as it's a great org. Also their CEO is basically the only one who stood up like this for trans people.
telegraph.co.uk/business/2025/âŠ
Co-op boss vows to âprotect trans people to the endâ
Interview: Shirine Khoury-Haq says non-binary people bring a âmassive business benefitâHannah Boland (The Telegraph)
If you're wondering about Marks and Spencer - I just did a Shodan Safari of their network boundary, Palo-Alto GlobalProtect VPN remote access access is still offline, 15 days later.
Online orders are still not working, and the store stock checker is disabled now.
Co-op pauses deliveries of non-essential items amid cyber attack - Retail Gazette
Co-op has paused its orders of non-essential products amid the fallout from its cyber attack.Eloise Hill (Retail Gazette)
M&S online shopping outage enters third week
Marks & Spencer enters the third week of its ecommerce platform suspension today (9 May), as the retailer continues to battle a cyber-attack.ÂSabina Weston (Drapers)
The Grocer reports 4 regional Co-ops, who arenât part of Co-op Group, are suffering stock shortages as they are supplied by Co-op Group.
They expect customers to start to see availability issues on shelves in the coming days.
thegrocer.co.uk/news/co-op-socâŠ
Co-op societies hit by availability issues amid cyberattack
Midcounties Co-op, Heart of England Co-op and Lincolnshire Co-op have all confirmed disruption to the supply of food to storesAlice Leader (The Grocer)
For orgs looking for defence tips for the attacks on UK retailers, this blog from 2022 about the UK teenagers in LAPSUS$ has relevance.
As a plot twist - not documented anywhere online, but LAPSUS$ first attacks in 2021 were against UK high street retailers.
microsoft.com/en-us/security/bâŠ
DEV-0537 criminal actor targeting organizations for data exfiltration and destruction | Microsoft Security Blog
The activity we have observed has been attributed to a threat group that Microsoft tracks as DEV-0537, also known as LAPSUS$. DEV-0537 is known for using a pure extortion and destruction model without deploying ransomware payloads.Microsoft Threat Intelligence (Microsoft Security Blog)
Hack rocks Marks & Spencer bureau de change
M&S bureau de change staff are being forced to use pen and paper to serve customers. The travel money desks are also unable to accept card payments in some cases.John-Paul Ford Rojas (This Is Money)
Co-op Group have provided some more detail about what itâs doing about remote lifeline stores (ones where theyâre the main/only retailer on an island):
âFrom Monday, 12 of the most remote lifeline stores will receive treble the volume of available product, and another 20 lifeline stores will get double the volume.â bbc.com/news/articles/c071e7x8âŠ
Co-op cyber attack: Islanders facing empty shelves say 'get the people fed'
The picturesque island of Islay in the Western Isles is dealing with the real world impacts of the major supermarket hack.Paul Ward and Lorna Gordon (BBC News)
Home
Explore exciting job opportunities at M&S across various sectors: In-Store, Digital & Tech, Clothing, Food, Support, and Logistics. Be part of Britain's best-loved brand, championing sustainability, inclusion, and innovation.jobs.marksandspencer.com
Fears 'hackers still in the system' leave Co-op shelves running empty across UK
U.K. retailer the Co-op is still having trouble with keeping grocery shelves stocked as it continues to respond to an attempted cyberattack that forced it to shut down some systems two weeks ago.Alexander Martin (The Record)
Allianz leads cyber cover for M&S ransomware attack
The Willis-brokered coverage also includes the Willis CyXS facility.Abbie Day (Insurance Insider)
This ITV News report linking the Co-op and M&S breaches to SIM swapping is not accurate, no source given. itv.com/news/2025-05-12/sim-swâŠ
They also have a report today saying Co-op stores are restocked, which is also not accurate - that one is sourced from Co-op, but obviously doesnât stack up to looking in Co-op stores.
If anybody is wondering, all of Marks and Spencer's Palo-Alto GlobalProtect VPN boxes are still offline, 3 weeks later. Pretty good containment method to keep attackers out.
Co-op's VDE environment is still down, too.
cyberplace.social/@GossiTheDogâŠ
Kevin Beaumont (@GossiTheDog@cyberplace.social)
Attached: 1 image M&S use Palo-Alto GlobalProtect for VPN, they took all the endpoints offline days ago (usually first stage containment for ransomware/extortion groups).Cyberplace
M&S says personal customer data stolen in recent cyber attack
The retail giant is still not taking online orders following a cyber attack three weeks ago.Michael Race & Joe Tidy (BBC News)
Co-op's AGM is this weekend, and M&S yearly results and investor contact are next week.
Gonna be awkward for different reasons, e.g. Co-op is member (customer) owned, so the people's data Co-op had stolen are effectively the shareholders and are invited.
CI Coop secures local supplies amid stock shortages
Bosses expect "steady improvements each day", after a cyber attack leads to empty shop shelves.Caitlin Klein (BBC News)
The Grocer reports Nisa and Costcutter are running out of fruit & veg, fresh meat and poultry, dairy products, chilled ready meals, snacks and desserts.
Nisa and Costcutter are supplied by Co-op Wholesale, which is dependent on Co-op Group.
âItâs really poor. I feel bad for them but what makes it worse is their hush-hush mentality about it. Thereâs no proper level of communication and we get random updates.â
Co-op Wholesale claim there are no problems. thegrocer.co.uk/news/nisa-and-âŠ
Nisa and Costcutter hit by Co-op cyberattack stock shortages
In communications sent to retailers, the symbol groups listed products that were either âtemporarily unavailableâ or âout of stockâ as a result of supplier issuesAlice Leader (The Grocer)
Co-op Group have told their suppliers that "systemic-based orders will resume for ambient, fresh, and frozen products commencing Wednesday 14 May". They say forecasting system will still be impacted.
thegrocer.co.uk/news/co-op-to-âŠ
Co-op to get systems back on track after cyberattack
As the Co-op turns orders back online, it has warned suppliers that it is unable to provide âaccurate product forecasting ahead of Wednesdayâs ordersâAlice Leader (The Grocer)
M&S cyber insurance payout to be worth up to ÂŁ100mn
UK retailer to file big claim as it admits for first time that some customer data was stolen in recent hackLaura Onita (Financial Times)
Co-op Group say they have exited containment and begun recovery phase theguardian.com/business/2025/âŠ
Marks and Spencer are still in containment
If you want figures for your board to set expectations in big game ransomware incidents, Co-op containment just over 2 weeks, M&S just over 3 weeks so far - recovery comes after.
In terms of external assistance, Co-op have Microsoft Incident Response (DART), KPMG and crisis comms. M&S have CrowdStrike, Microsoft, Fenix and crisis comms.
Co-op cyber-attack: stock availability in stores âwill not improve until weekendâ
Group in ârecovery phaseâ and working closely with suppliers after customers complain of empty shelvesSarah Butler (The Guardian)
The threat actor at Co-op says Co-op shut systems down, which appears to have really pissed off the threat actor. This was the right, and smart, thing to do.
While I was at Co-op we did a rehearsal of ransomware deployment on point of sale devices with the retail team, and the outcome was a business ending event due to the inability to take payments for a prolonged period of time. So early intervention with containment was the right thing to do, 100%.
bbc.co.uk/news/articles/cwy382âŠ
'They yanked their own plug': How Co-op averted an even worse cyber attack
The revelation - from the criminals responsible - explains why the Co-op is getting back to business faster than M&S.Joe Tidy (BBC News)
M&S have finally told staff that data about themselves was stolen: telegraph.co.uk/business/2025/âŠ
You may notice I said they had staff data stolen on May 9th in this thread.
M&S staff data stolen by hackers in cyber attack
Employeesâ email addresses and full names have been taken by hackers, sources claimMatthew Field (The Telegraph)
For the record, the tools listed in this article aren't used by Co-op.
computing.co.uk/news/2025/secuâŠ
The link in the article to Vectra Cognito AI has a Coop Sweden logo on it, and the Coop Sweden CISO is named. Coop Sweden is different company. Coop Sweden went on to have a ransomware attack that crippled the org, including point of sale, so I don't think it's a good sales point. Same with Silverfort.
Google AI has ingested the article and now uses it to claim Co-op Group use the tools.
Here are the cyber tools Co-op used to help defeat its recent ransomware attack
Computing research has identified the security tools and partners the Co-op used to stop last monthâs cyberattack in its tracks.www.computing.co.uk
M&S chief executive faces ÂŁ1.1mn pay hit after cyber attack
Stuart Machinâs awards set to shrink after UK retailerâs share price drops following disclosure of sweeping hackLaura Onita (Financial Times)
The Times reports M&S were breached through a contractor and that human error is to blame. (Both M&S and Co-op use TCS for their IT Service Desk).
The threat actor went undetected for 52 hours. (I suspect detection was when their ESXi cluster got encrypted).
M&S have told the Times they had no âdirectâ communication with DragonForce, which is code for theyâre using a third party to negotiate - standard practice.
M&S looks to be moving to reposition their incident as a third party failure, which I imagine will help redirect some of the blame (they present their financial results during the week to investors): bbc.co.uk/news/articles/cpqe21âŠ
Both M&S and Co-op outsourced their IT, including their Service Desk (helpdesk), to TCS (Tata) around 2018, as part of cost savings.
M&S hackers believed to have gained access through third party
The retailer has been struggling to get its services back to normal after a cyber-attack in April.Emma Simpson (BBC News)
There's nothing to suggest TCS itself have a breach btw.
Basically, if you go for the lowest cost helpdesk - you might want to follow the NCSC advice on authenticating password and MFA token resets.
I've put a 3 part deep dive blog series coming out probably next week called Living-Off-The-Company, which is about how teenagers have realised large orgs have outsourced to MSPs who follow the same format of SOP documentation, use of cloud services etc. Orgs have introduced commonality to surf.
M&S Hong Kong not responding to Privacy Commissioner's Office after online customer data breach
The Office of the Privacy Commissioner for Personal Data says M&S Hong Kong has not informed it of a recent customer data leak, nor responded to its enquiries.Tom Grundy (Hong Kong Free Press HKFP)
"Cyber analysts and retail executives said the company had been the victim of a ransomware attack, had refused to pay - following government advice - and was working to reinstall all of its computer systems."
Not sure who those analysts are, but since DragonForce haven't released any data and M&S won't comment other than to say they haven't had any "direct" contact with DragonForce, I wouldn't make that assumption.
There's also a line in the article from an cyber industry person saying "if it can happen to M&S, it can happen to anyone" - it's ridiculous and defeatist given Marks and Spencer haven't shared any technical information about how it happened, other than to tell The Sunday Times it was "human error"
The Air Safety version of cyber industry would be a plane crashing into 14 other planes, and industry air safety people going "Gosh, if that can happen to British Airways it could happen to anybody!"
Tomorrow itâs one month since Marks and Spencer started containment, itâs also their financial results day.
Online ordering still down, all recruitment stopped, Palo-Alto VPNs still offline.
TCS have been linked to the Marks and Spencer breach, at least in part.
M&S cyber-attack disruption to last until July and cost ÂŁ300m
Customers have been unable to order online for almost a month due to the cyber-attack.Lucy Hooker (BBC News)
The NCA has confirmed on the record that the investigation into the M&S and Co-op hack is focused on English teenagers. I could toot the names of the people I think theyâll pick up, but wonât.
bbc.co.uk/news/articles/ckgnndâŠ
M&S and Co-op hacks: Scattered Spider is focus of police investigation
The National Crime Agency tells the BBC how it is trying to find the culprits of the M&S and Co-op hacks.Joe Tidy (BBC News)
This stuff is brilliant. Based on e-paper and runs on Zigbee.
And they can raise the prices between you picking things off the shelf and going through the checkout and you'll have no proof that it was offered at a lower price.
Has been done since the ransomware incident.
pssscht. Like that would ever happen lol
bbc.com/news/technology-577075âŠ
Swedish Coop supermarkets shut due to US ransomware cyber-attack
Some 500 stores are forced to close due to the ripple effects of a major cyber attack in the US.By Joe Tidy (BBC News)
e-paper price labels are apparently extremely common in mainland Europe. The UK is extremely slow to adopt things like this.
*In theory*, during an incident, the labels would remain as-is until they receive a new price. So TAs would specifically need to target the pricing database prior to wiping.
TCS has a security incident running around the M&S breach.
Interestingly the source claims TCS aren't involved in Co-op's IT - which is categorically false, they took over most of it while I worked there, including the helpdesk, and my team (SecOps) after I left.
ft.com/content/c658645d-289d-4âŠ
Tata Consultancy Services carries out internal probe into M&S hack
Indian IT company investigating whether it was gateway used by criminals to access retailerChris Kay (Financial Times)
Insurance Insider say Co-op Group have no cyber insurance policy.
Itâs got the insurance industry hard as they think they can ambulance chase other orgs with it.
insuranceinsider.com/article/2âŠ
M&S attacks could be the key to winning new cyber business
While M&S had a cyber policy in place, Co-op and Harrods did not, Insurance Insider revealed.Abbie Day (Insurance Insider)
DragonForce actors target SimpleHelp vulnerabilities to attack MSP, customers
Ransomware actor exploited RMM to access multiple organizations; Sophos EDR blocked encryption on customerâs networkSophos News
While Co-op have restored every customer facing system and internal systems like recruitment and remote working, M&S still don't even have recruitment back.
I'm reliably told they paid the ransom, so they'll be target #1 basically forever with other ransomware groups now due to resiliency woes and willingness to pay.
bbc.co.uk/news/articles/c23mz5âŠ
M&S boss's pay hits ÂŁ7m before cyber attack chaos
Stuart Machin's money is not affected by the IT disruption but it will be considered for next year's pay.BBC News
M&S staging walk-in recruitment open days amid cyberattack disruption
M&S suspended online recruitment, along with clothing and home orders, after hackers took control of its systems in a cyberattack in AprilSteve Farrell (The Grocer)
This Daily Mail piece about security leaders thinking work-from-home means they will be crippled is horseshit, I'm not linking it.
They've taken a survey about how security people think their businesses couldn't survive ransomware, and linked it to working from home. WFH isn't the problem: business IT and resilience being built on quicksand is the problem.
Looks like a product of the "a good lie contains as much truth as possible" school.
The connection to WFH is spurious; but only two thirds sounds low for "We don't really understand our problems; but they are probably apocalyptic".
The 'WFH' allegations seem in especially bad faith given the suspected entry point for the M&S compromise: the outsourced helpdesk.
Those guys are even more compliant labor than work-not-from-home employees, so the Daily Heil isn't going to say anything; but lack even the (informal; but in practice often at least reasonably effective) "does the IT person you just poked recognize who is interrupting with a password question?" ID verification step with onsite workers and onsite IT.
It wouldn't be the whole story either, but it's just as true.
Co-op say they have largely completed recovery, and have removed the cyber attack banner and statement from their website
retailgazette.co.uk/blog/2025/âŠ
I think they did a great job. They do call it a "highly sophisticated attack", which, frankly.. isn't true and may come out in open court later if the suspects are ever caught.
6 weeks from containment to "near full" recovery, for statto nerds like me who track this stuff.
Co-op nears âcomplete recoveryâ from cyber attack - Retail Gazette
Co-op has said itâs in a âmuch stronger positionâ as store deliveries return to normal following its cyber attack.Aoife Morgan (Retail Gazette)
M&S had their ransomware incident communicated via internal email - from the account of a staff member who works for TCS.
The way TCS work is you give them accounts on your AD.
bbc.co.uk/news/articles/cr58pqâŠ
M&S hackers sent abuse and ransom demand directly to CEO
The criminals told the retailer's boss he could make things "fast and easy" if he complied with their demands.Joe Tidy (BBC News)
Marks and Spencer have started partial online shopping again.
For statto nerds, around 7 weeks from containment to partial recovery
bbc.co.uk/news/articles/c4gevkâŠ
M&S restarts online orders after cyber attack
The return of online shopping marks a key milestone for the retailer, which has struggling to get services back to normal.Michael Race (BBC News)
TCS have told shareholders their systems were not compromised in the hack of M&S.
As an explainer here (not in the article): TCS IT systems weren't compromised. Their helpdesk service (they're AD admins at M&S) was used to gain access to M&S. They manage M&S IT systems.
reuters.com/business/media-telâŠ
Latest Marks and Spencer update is pretty crazy.
M&S haven't been able to supply sales data - so the British Retail Consortium (BRC) - used by the UK government as as economic indicator - basically made up figures for M&S and didn't tell people they had done this.
telegraph.co.uk/business/2025/âŠ
Retail lobby group accused of M&S cyber cover-up
British Retail Consortium published âmade-upâ sales figures following attack on high street giantHannah Boland (The Telegraph)
I'd be very curious to know what the breakdown is between TCS dropping the ball and lying about it and M&S/Co-op not actually insisting on adequate procedure.
It's not terribly uncommon for people to only care about time-to-resolution with some lip service to user satisfaction when it comes to helpdesk metrics; and tacitly discourage things that are slow and unpleasant like hassling people for ID, at least until that becomes a visibly terrible idea.
"M-SThrowaway" might indicate M&S?
Or is that too obvious or deliberate obfuscation? đđ€·ââïž
as someone who has been subjected to Tata on multiple occasions going back over a decade?
This isn't nearly spicy enough. I don't even describe them as a 'body shop' because they'd gladly route you to a corpse and try to charge extra for '24x7 coverage.'
When one employer did a basic security audit of their helpdesk services, Tata failed so severely that the contract was pulled for cause before the audit was even completed. They moved it all back in-house.
The root problem here isn't that TCS are shockingly bad (they are, just about everyone knows that).
The root problem is that "management decisions" constantly overrule those that raise concerns about their service and tell any remaining internal IT and security staff to "deal with it as best you can."
I'm very much of the view that, yes, the outsourced provider can be the cause of an incident, they can provide a shockingly bad service, they can cost your business millions of pounds. But the decision to continue to use them when you already know this is a real possibility - that's a decision by senior management within the company. That's on you.
Interesting. I don't have the background on this specific attack, but I'm reminded of the Target credit card theft. An HVAC company near me was the point of entry for the attackers; they had high-access keys to Target's intranet because they install and maintain shopping-mall-grade HVAC and can remote-override it for maintenance and schedule reasons (nation-scale chain stores with giant footprints save not-inconsequential money on things like "Don't power up the HVAC to normal capacity on days nobody is here").
They had the keys on the same machine running their webserver.
(Meanwhile, Target actually did get an SEC slap-on-the-wrist for one specific thing: the HVAC intranet piece wasn't firewalled from the financial transactions and cash register source code pieces).
Marks and Spencerâs CEO says half of their online ordering is still offline after their ransomware incident, they hope to get open in next 4 weeks.
They are also rebuilding internal systems and hope a majority of that will be done by August.
Lesson: mass contain early. M&S didnât. Co-op did.
17 and two 19 year old teens picked up over Co-op and M&S hacks, and a 20 year old woman.
Pretend to be surprised.
bbc.com/news/articles/cwykgrv3âŠ
Four arrested in connection with M&S and Co-op cyber attacks
Three men and one woman - aged between 17 and 20 - have been arrested in London and the midlands.Joe Tidy (BBC News)
. @briankrebs has broken the story that the key member (and teenager) of LAPSUS$ runs Scattered Spider
krebsonsecurity.com/2025/07/ukâŠ
UK Charges Four in âScattered Spiderâ Ransom Group
Authorities in the United Kingdom this week arrested four alleged members of "Scattered Spider," a prolific data theft and extortion group whose recent victims include multiple airlines and the U.K. retail chain Marks & Spencer.krebsonsecurity.com
Co-op finally admitted the entire membership database was stolen
I had this in the thread months ago, they originally tried to deny it entirely then tried to say âsomeâ data was accessed when they knew it was the whole thing.
bbc.co.uk/news/articles/cql0plâŠ
Co-op boss says sorry to 6.5m people who had data stolen in hack
In her first interview since the attack, Co-op's chief executive said she was "incredibly sorry" to customers.Joe Tidy (BBC News)
Personally I think Co-op did a really good job getting out of that situation and minimising impact.
I definitely think if you have a LAPSUS$ style advanced persistent teenagers situation, tilt towards open and honest comms as those kids will use secrecy against ya. Itâs 2025, itâs okay to say you got hacked, people largely understand. Also, in IR, lawyers are usually stuck in 1980 advice - itâs just advice, they ainât yo boss.
Itâs 2025, itâs okay to say you got hacked, people largely understand.
Probably the most damning indictment of the entire computing industry that I've seen for a long time.
I don't disagree at all. But this absolutely should not be the case and wouldn't be if we weren't still building core infrastructure around ideas that were known to be bad by the mid 1980s.
The people arrested as part of the Co-op and M&S hack investigation have been released on bail.
nation.cymru/news/four-people-âŠ
Previously when this happened with LAPSUS$, they just continued hacking stuff.
Four people bailed after arrests over cyber attacks on M&S, Co-op and Harrods
Four young people who were arrested for their suspected involvement in the damaging cyber attacks against Marks & Spencer, the Co-op and Harrods, have been bailed.Emily Price (Nation.Cymru)
at this point I'm much more surprised when someone over 25 gets picked up for hacking stuff, I think some dude was helping gangs smuggle drugs into Rotterdam via hacking into the port logistical systems, they were like 41 with kids, that was way more unexpected to me lol
occrp.org/en/project/narcofileâŠ
Inside Job: How a Hacker Helped Cocaine Traffickers Infiltrate Europeâs Biggest Ports
Europeâs commercial ports are top entry points for cocaine flooding in at record rates. The work of a Dutch hacker, who was hired by drug traffickers to penetrate port IT networks, reveals how this type of smuggling has become easier than ever.OCCRP
At least the companies used sophisticated defense in depth.
âThe BBC later discovered from the criminals that the company disconnected the internet from IT networks in the nick of time to stop the hackers from deploying ransomware and so causing even more disruption.
"Shortly after Co-op announced it had been attacked, luxury retailer Harrods said it too had been targeted and had been forced to disconnect IT systems from the internet to keep the criminals out.â
If it is the case then the leaders of businesses like M&S who outsource these services to the lowest cost providers should also be held to account
Itâs typical of British business management to know the cost of technology but not the value of it
In other words, their wetware was targeted.
"Our staff is our most valued asset. We depreciate on it."
The term 'user' in "no TCS systems or users compromised" could be more interesting to argue on in a civil liabilities case.
If a TCS staff member falls for social engineering (even if the action they take is within an assigned M&S tenant account...), is that not the same as a TCS user being compromised?
Anyway... I'm sure that statement won't at all be like rubbing salt in M&S's wounds.
wasn't there some event, maybe 5 years ago, that meant a lot of WFH? Or did I hallucinate those times.
Is it suddenly a problem now or this is the same RTO bullshit being peddled?
Want to guess how much of my IT leadership career has been focused on building in-house expertise and dialing back the presence of MSPs?
Enough that it's made for a pretty good living...
when I got my business degree, one of my management profs said that the instant you outsource, you give up control. To the service provider, you move from income to liability on the balance sheet because you now are costing them money, and to eke out any profit they need to cut costs related to providing service to you.
Thus you get all this *gestures vaguely*
"paints a ticking timebomb" - bit of a mixed metaphor, could be "paints a target" or "plants a ticking timebomb" ? đ
The shortsightedness of outsourcing everything is undeniable though!
I would love for IT to publish accident investigation reports in the same way as aviation.
No blame, no liability, no finger pointing, just lessons for everyone to learn and hopefully avoid the same.
(I know there have been some like the Irish Health Service that were excellent.)
yeah, breach the "low cost" IT outsourcer - whose staff feel little connection or affinity with the corporate customer - and *bingo* you hit the jackpot đ° with multiple corporate accounts to ransom.
How's that "low cost IT outsourcing" looking now?
1. Personnel is not allowed to store passwords.
2. Must use unique passwords for every service.
3. Passwords must rotate every X days.
4. Only sanctioned apps are allowed.
5. No password manager is sanctioned or installed by default.
I recall it was a "TCS_80_ip" list in Entra Id marked "Trusted"/"MFA exempt" that contained 80 ranges from /15 to /24...
Yet happily pivoting through 3 layer deep RDP to get to a system to manage
âwe arenât a computer company, so off to India / China / Vietnam / Philippines / etc for all this non-core-business shitâ
âŠ
âWhy company not run without computers? Who did this?â
to be fair, IIRC, Coop Sweden went down because their payment provider used Kaseya.
So, it was ransomware on a fourth party, nothing Coop Sweden had any direct control over
The quote
> They torched shareholder value
made me laugh
they have no idea what the Coop is
Just glad some of the lessons sank in....
the thieves could probably show up at the AGM and present themselves as a member, since they have access to all the information the Co-Op has on it's membership...number, address, etc.
Short of checking govt. ID or requiring a hard copy of the meeting invite that was mailed to their address. Even then, the thieves might've gotten away with that too.
Incident response specialists the world over wince into their keyboards.
This is another object lesson in how not to do it. It'll be taught to students in future.
I can only hope this data breach is the kick up the arse needed to abolish the common practice of using date of birth as an (immutable!) security password. Once itâs public knowledge itâs beyond useless⊠itâs a liability. Especially in banks.
I will not be holding my breath on this one.
I was on holidays in Brodick (Arran, Scotland) last sunday, I can confirm the Co-op was low on products, with only potatoes available as fresh vegetables đŹ
I though it was because it was a sunday late afternoon, but reading your thread it was clearly linked to the cyber incident
Co-op cyber attack leaves island shop shelves empty
The attack has disrupted deliveries to island communities where Co-op is one of the biggest retailers.BBC News
Not sure if it is related, but M&S shuttered a flag-ship store without notice and earlier than planned on May 7th.
đ Marks and Spencer suddenly closes Aberdeenâs flagship St Nicholas branch after more than 80 years in city centre pressandjournal.co.uk/fp/news/âŠ
They've now admitted it -
BBC News - Personal customer data stolen in M&S cyber attack
bbc.com/news/articles/c62v34zvâŠ
M&S says personal customer data stolen in recent cyber attack
The retail giant is still not taking online orders following a cyber attack three weeks ago.Michael Race & Joe Tidy (BBC News)


Well, that's an easy one. Just say that you are calling regarding the reported problem with Outlook.
On the one hand you have a ~90% Chance, that the called person had.a Problem in the last Week, and on the other hand will hand you over the username as well as the password immediately.
I'm somewhat surprised, that this had not been tried earlier.
Edit: Done
Huh, might also explain why some of the shelves were so bare at my local yesterday.
(Also, it was a Bank Holiday Monday, but still)
While in #BandQ today, the staff said they'd been having "some IT Issues like M&S"
Not sure if this was the staff just making a parallel of "generic IT issues" or if there has been some incident they haven't admitted yet
Can also confirm, from several years ago, that sometimes there is also an Executive Assistant with a flag in some systems to âcall on behalf ofâ C-Suite/VPs.
Itâs like a privilege escalation on people exploit đ€Łđ
The cult of âitâs an exec!â and thus able to bypass normal protocols has always made me cry - especially seeing as how theyâre the ones with access to the juicy stuff and (usually) have low IT literacy and awareness.
Often, when Iâve worked with an org to help strengthen the help desk, the push back has been from the service desk management (scared that theyâll been seen as impeding the exec in the course of Important Work). Usually asking the question âwould you rather be responsible for an extra 60 seconds on a call, or for the entire company being breached?â helps them to see the light.
The other source of friction is from the admin assistants of the execs who seem even more entitled than the execs themselves. An appeal to vanity (âwe have to be extra careful when you call in because youâre in a very privileged positionâ) can work wonders.
Every time Iâve spoken directly with said execs and explained exactly why they are going to be asked to positively ID themselves for any interaction they have been 100% supportive.
This is basically the plan for most businesses in reality.
It's fine to talk about stuff being "widely known best practice," but when IT shows up with big expenses for backups and security, the MBA's always decide it's more important to rightsize the headcount and operate lean. Many IT departments report up through an MBA and not a technical person, and many IT people are terrible at communicating risk dramatically enough to get money.
The thing that gets me is that the two statements are probably true for the people who said them. The Security group may have wargamed and prepared for malware attacks, and done so in a way that no one else in the technical stack even noticed happening (beyond some new agent installs being requested). So when the attack comes, the Security plan swings into action and no one outside of Security knows what it is or has practiced it.
This is high visibility. Executives step in to make Declarations, complicating the response. This is an incident big enough to need sub-commands to track various workflows, reporting up to a rotating incident command. Everyone wants to help, the workflows aren't well defined yet, and people help on their own authority (thanks to Command not having a clear picture yet and guiding where help would be good) and maybe make things worse in a few spots.
We had a plan.
It is chaos.
Both are true.
@ollie_whitehouse
Do egress filtering (esp. for servers) with alerting.
If there is unknown communication, then you have either a misconfiguration or a problem.
Keep critical IT infrastructure (network, firewalls, SAN/NAS, virtualisation, backups) separated from Active Directory.
Do not couple internet-facing systems (including VPN and M365) with your local AD.
I agree with most of your arguments. (In fact, the only one I take exception with is comparing ransomware with climate change. Ransomware is a much more real and urgent problem.) Those are pretty much arguments I've used myself when advising customers hit by ransomware not to pay.
But, ultimately, it's the company's decision. Even if the company makes the wrong decision, the government shouldn't be the one who decides for them.
See also this:
coveware.com/blog/2025/4/29/thâŠ
"Decryption tools are worse than theyâve ever been."
The organizational structure of ransomware threat actor groups is evolving before our eyes
The Ransomware-as-a-service (RaaS) model has not recovered from law enforcement disruption, and the entrance of novice actors along with non-Russian state-linked cybercriminals has led to uncertain outcomes for victims.Bill Siegel (Coveware: Ransomware Recovery First Responders)
When the first indication appears, shut everything down. I have seen banks do this, and watched tellers calmly tell customers "I'm sorry, but the system is temporarily shut down" and start from there.
If the breach is stopped quickly enough, you may have a chance.
Also, what about off site storage, that would not be accessible to the attacker?
Ultimately, the decision is a risk management decision, to evaluate as quickly as you can
"Travelex arenât alone. When I covered the Capita ransomware, they paid quietly paid"
maybe delete one of the "paid"s
Inside the M&S meltdown: 3am meetings and ÂŁ40m a week in lost sales â The Times and The Sunday Times
Stuart Machin had been looking forward to a long weekend. It was Easter Saturday and the chief executive of Marks & Spencer had retired to his south London home for the evening, after a long day inspecting the aisles of his local M&S branch â somethiâŠapple.news
Unknown drone attack targets Taji Camp in Baghdad, Iraq
Multiple explosions were heard in the Iraqi capital, Baghdad, particularly at Camp Taji, a military installation used by Iraqi and the US-led coalition forces.Al Mayadeen English (Unknown drone attack targets Taji Camp in Baghdad, Iraq)
A. prepare defenses?
B. attack first?
C. do what the enemy wanted before they get a chance to do it?
Sensitive content
Sensitive content
Sensitive content
Sensitive content
Xi to attend gathering marking 80th anniversary of victory against Japanese aggression, fascism - China Military
Chinese President Xi Jinping will attend a gathering marking the 80th anniversary of the victory in the Chinese People's War of Resistance Against Japanese Aggression and the World Anti-Fascist War.eng.chinamil.com.cn
You can follow us in other languages. Visit our website for more information wordsmith.social/protestation/âŠ
Social
Englishâ @protestation@friendica.eskimo.comFrançaisâ @protestation@social.trom.tfâ @protestation@mastodon.social
Deutschâ @protestation@friendica.opensocial.space
PortuguĂȘsâ @protestation@mastodon.acc.sunet.seâ @protestation@friendicarg.nsupdate.info
Quotesâ @protestation@embers.socialâ @protestation@freeradical.zone
Hamas' Al-Qassam Brigades execute complex ambush on zionist force in Gaza
Hamas' Al-Qassam Brigades execute complex ambush on zionist force in Gaza
Al-Qassam Brigades, the military wing of the Islamic Resistance Movement (Hamas), announced on Tuesday that its fighters carried out a complex ambush targeting a Zionist force entrenched inside a house south of Khan Younis in the southern Gaza Strip.www.saba.ye
#gaza #palestinian #children #palestine #civilians #siblings #parents #children #loss #suffering #pain #deaths #killings #endisraelswarcrimes #stopisrael #childmurder
This Palestinian boy was #MurderedbyIsrael yesterday.
Workers and students in Manchester and Bradford speak out against Iran war, Palestine Action ban - World Socialist Web Site
wsws.org/en/articles/2025/06/2âŠ
Workers and students in Manchester and Bradford speak out against Iran war, Palestine Action ban
Ahmed, a rail worker, told WSWS, âThe attack on Iran is totally unjustified, itâs also a total threat to democracy⊠Before we know it, we wonât be able to protest.âWorld Socialist Web Site
reshared this
Nanook reshared this.
Acabo de enterarme que Willyrex ha vuelto a las andadas y ahora se ha metido en el tema de las IAG.
Ahora tengo todavĂa mĂĄs ganas de que pete la burbuja para que este se vuelva a estampar por una mierda tecnolĂłgica.
AI training, per se, is now considered "fair use" and Constitutionally protected in the U.S.
news.bloomberglaw.com/ip-law/aâŠ
Anthropic Wins Right to Use Copyrighted Books to Train AI Models
Anthropic PBC convinced a California federal judge that using copyrighted books to train its generative AI models qualifies as fair use.Annelise Levy (news.bloomberglaw.com)
if ai training is fair use, and whatever ai produces is effectively public domain...
i feel like this is the best path to completely destroy copyright once and for all
la respuesta de IrĂĄn al ataque
inicial de Netanyahu el mundo
occidental se posicionara con
ellos. No ha sido asĂ, y no lo ha
sido gracias a la visibilizaciĂłn y
la movilizaciĂłn que ha hecho la
gente de todo el mundo al ver el
genocidio. Ahora es mucho mĂĄs
difĂcil para Israel y EEUU que la
gente les apoye en su deriva
belicista. La difusiĂłn y la presiĂłn
de la gente, funciona. Sigamos
haciéndolo. ¥Viva Palestina libre!
delighted to announce that my new zine "The Secret Rules of the Terminal" is out today!!
You can get it for $12 USD here: wizardzines.com/zines/terminal
The reason this zine is called "The Secret Rules of the Terminal" is that I learned more useful things while writing this zine than when writing any other zine, even though I've been using the terminal every day for 20 years.
It really left me feeling like the terminal is full of hidden secrets -- because "the terminal" is made up of so many different pieces, there's no single terminal manual you can read!
Here's the table of contents (which as a bonus shows the components of the terminal!)
Cool cover! The middle woman looks a lot like Franka:
A federal judge sides with Anthropic in lawsuit over training AI on books
Link: techcrunch.com/2025/06/24/a-feâŠ
Discussion: news.ycombinator.com/item?id=4âŠ
A federal judge sides with Anthropic in lawsuit over training AI on books without authors' permission | TechCrunch
The ruling isn't a guarantee for how similar cases will proceed, but it lays the foundations for a precedent that would side with tech companies over creatives.Amanda Silberling (TechCrunch)
Audio: Trumpâs attack on Iran is âunconditional surrenderâ to Israel
Narrated version: Shunning the US intelligence consensus, Trump and top principals rely on Israeli fraud to bomb Iran.Aaron Maté (Aaron Mate)
« Iran, US, France: faire entendre la voix des peuples » - QG TV
What comes next, as war escalates?
How can Iran counter a US-Israeli assault aimed at its destruction?The Electronic Intifada
Sensitive content
QUE RETENIR DES 12 JOURS DE CONFRONTATION ENTRE LâIRAN ET ISRAĂL ?
Infos Brutes- 24/06/25La confrontation inĂ©dite entre lâIran et IsraĂ«l aura durĂ© prĂšs de deux semaines, marquant une rupture majeure dans la dynamique rĂ©gionale. Le cessez-le-feu, initiĂ© par les Ătats-Unis, tĂ©moigne de la volontĂ© israĂ©lienne dâĂ©viter une dĂ©savantageuse guerre d'usure. Cette initiative reflĂšte en rĂ©alitĂ© un signal d'essoufflement dâIsraĂ«l. Mais que nous enseignent rĂ©ellement ces douze jours dâĂ©changes de frappes ?
- Sur le plan politique interne iranien
Lâattaque israĂ©lienne, justifiĂ©e par le prĂ©texte nuclĂ©aire, nâa pas affaibli la RĂ©publique islamique. Au contraire, elle a consolidĂ© la cohĂ©sion nationale. Face Ă lâagression, le peuple iranien a resserrĂ© les rangs autour du rĂ©gime, dĂ©montrant que la capacitĂ© de rĂ©sistance dâune Nation repose avant tout sur lâunitĂ© de son peuple.
- Sur le plan technologique â Iran
LâIran a pu tester grandeur nature ses missiles balistiques Ă longue portĂ©e. Au-delĂ de la dĂ©monstration de puissance, câest une opportunitĂ© dâajustement technique. LâexpĂ©rience de terrain servira Ă perfectionner ces armes, Ă les rendre plus prĂ©cises et potentiellement plus dissuasives Ă lâavenir.
- Sur le plan technologique â IsraĂ«l
La supériorité technologique israélienne, longtemps considérée comme un acquis, a été sérieusement mise à rude épreuve. Malgré la présence du DÎme de Fer, des systÚmes avancés de défense antimissile et la puissance de son aviation, les missiles iraniens ont percé les « rideaux de protection » et atteint des cibles stratégiques, ébranlant la confiance dans ces boucliers.
- Sur le plan tactique â #IsraĂ«l
Des dĂ©cennies dâassassinats ciblĂ©s de scientifiques iraniens nâauront pas empĂȘchĂ© lâIran de maĂźtriser la technologie nuclĂ©aire. Les bombardements israĂ©liens, en partie aveugles, nâont pas dĂ©truit les capacitĂ©s et le savoir-faire nuclĂ©aires de lâIran. La centrale nuclĂ©aire de Bushehr n'a pas Ă©tĂ© touchĂ©e et l'incertitude demeure sur l'efficacitĂ© des frappes sur les infrastructures souterraines. Pire encore, le stock d'uranium hautement enrichi dissimulĂ© ne finira pas de hanter Tel-Aviv.
- Sur le plan #géopolitique
Lâimage dâinvincibilitĂ© dâIsraĂ«l en sort affaiblie. Pour la premiĂšre fois, un Ătat souverain a revendiquĂ© et exĂ©cutĂ© des frappes en profondeur sur le territoire israĂ©lien avec un lourd bilan humain et des dĂ©gĂąts considĂ©rables. Cette brĂšche stratĂ©gique aura un impact durable sur la perception de la superpuissance militaire d'IsraĂ«l.
- Sur le plan tactique â Iran
LâIran sâattellera dĂ©sormais Ă renforcer considĂ©rablement ses systĂšmes de dĂ©fense aĂ©rienne. Lâinvestissement dans des technologies hypersoniques et furtives deviendra une prioritĂ©, tout comme la dissimulation accrue des infrastructures militaires stratĂ©giques pour renforcer sa dissuasion et sa capacitĂ© de projection.
- Sur le plan de la retenue iranienne
MalgrĂ© sa capacitĂ© Ă infliger des dĂ©gĂąts considĂ©rables, lâIran a fait preuve de retenue stratĂ©gique. Il aurait pu viser la centrale nuclĂ©aire de Dimona ou les installations de dessalement, provoquant une catastrophe humanitaire et Ă©cologique. Ce choix dĂ©libĂ©rĂ© de ne pas franchir certaines lignes rouges montre une volontĂ© de ne pas provoquer une guerre totale.
Bien que la Russie et la Chine aient ouvertement condamné les frappes israéliennes, leur soutien concret se veut plus discret. La présence de scientifiques russes sur certains sites iraniens suggÚre une collaboration étroite dans le nucléaire et le militaire. Les missiles iraniens devenus subitement performants prouvent l'efficacité de la coopération militaire et technologique avec la Russie, la Chine, la Corée du Nord et le Pakistan.
- Sur le dossier #nucléaire
La situation ramĂšne paradoxalement le dossier nuclĂ©aire iranien Ă son point de dĂ©part: la voie diplomatique. LâIran se retrouve en position de force pour relancer les nĂ©gociations avec ses conditions ou, au contraire, accĂ©lĂ©rer discrĂštement sa transition vers le nuclĂ©aire militaire, s'il est considĂ©rĂ© par TĂ©hĂ©ran comme seule garantie de sĂ©curitĂ© face Ă des menaces existentielles.
- Sur le plan militaire israélien
HabituĂ© Ă affronter des groupes non Ă©tatiques comme le Hezbollah ou le Hamas, IsraĂ«l dĂ©couvre les limites de sa stratĂ©gie face Ă un Ătat organisĂ©, disposant de moyens balistiques consĂ©quents. Lâoption militaire perd de son attractivitĂ© stratĂ©gique, et la confiance dans les systĂšmes dâalerte prĂ©coce et de dĂ©fense est sĂ©rieusement entamĂ©e.
- Sur le plan des pertes humaines et matérielles
MalgrĂ© une communication strictement contrĂŽlĂ©e par Tel-Aviv, de nombreux observateurs remettent en question le bilan humain en raison de lâampleur des dĂ©gĂąts. L'Ă©tendue des destructions Ă HaĂŻfa, Tel-Aviv ou Beersheba , associĂ©e aux indemnisations civiles et au coĂ»t des interceptions, pĂšsera lourdement sur l'Ă©conomie israĂ©lienne, mĂȘme avec le soutien amĂ©ricain.
- Sur le plan de la politique intérieure israélienne
#Netanyahou a momentanĂ©ment renforcĂ© sa position en dĂ©tournant lâattention de ses ennuis judiciaires et Ă se maintenir au pouvoir. Mais lâopinion publique, dâabord favorable Ă lâattaque, pourrait basculer face aux limites rĂ©vĂ©lĂ©es par la riposte iranienne. La paix avec les voisins s'imposera dĂ©sormais comme une option crĂ©dible.
- Sur le rapport de force régional
Cette confrontation aura des effets durables sur lâĂ©quilibre rĂ©gional. Les Ătats arabes observeront avec attention la capacitĂ© dâun Ătat comme lâIran Ă tenir tĂȘte militairement Ă IsraĂ«l. Cela pourrait redessiner les alliances, refroidir certaines normalisations diplomatiques, et rĂ©activer des dynamiques de dissuasion nuclĂ©aire au #Moyen-Orient.
- Sur le plan du droit international
Lâagression israĂ©lienne contre lâ #Iran, sans justification reconnue par le droit international, viole la Charte des Nations unies. Pourtant, les Ătats occidentaux nâont ni condamnĂ© cette action ni rappelĂ© les principes de souverainetĂ©. En invoquant une « guerre prĂ©ventive » â non reconnue juridiquement â pour justifier lâattaque, ils valident un double standard. Or selon leur propre dĂ©finition, les Ătats qui ne respectent pas le droit international sont qualifiĂ©s d'«Ătats voyous».
Caek Islove đ° đ
in reply to Oven_Operators_LU_88 • • •