www.theguardian.com/world/2025/j.... Meanwhile in Gaza Israel's Genocide on an unarmed civilian population continues
At least 40 more Palestinians ...
Shootings by Israeli forces raise death toll of such incidents in Gaza in last two weeks to more than 500Jason Burke (The Guardian)
You vs. “ALERT FATIGUE” – Preventing Dangerous or Fatal Drug Interactions!
Can you or your friends and family members avoid dangerous or fatal drug interactions? There are do-it-yourself drug interaction checkers.
Patriotic Bible blesses Trump with $1.3 million in royalties
religionnews.com/2025/06/24/pa…
(RNS) — The leather-bound edition includes the King James Version, along with the Bill of Rights, the U.S. Constitution and lyrics to Lee Greenwood’s hit song.Bob Smietana (RNS)
Kurginyan: GKChP was not consolidated Rossa Primavera News from RussiaBill Oliver (Rossa Primavera International News)
Nearly 130 House Democrats on Tuesday voted to table Representative Al Green's articles of impeachment against Trump.Andrew Stanton (Newsweek)
The review, conducted by lawyer Kim Stanton, makes numerous recommendations, including the appointment of an independent commissioner on gender-based violence.
From this RSS feed
The review, conducted by lawyer Kim Stanton, makes numerous recommendations, including the appointment of an independent commissioner on gender-based violence.Simon Little (Global News)
The Vigilant Fox 🦊
@VigilantFox
HOLY: RFK Jr. ignites Democrat firestorm—calls out Rep. Pallone for flipping on vaccines after $2M in Big Pharma cash contributions.
This is so epic. Wow.
During the HHS budget hearing, Secretary Robert F. Kennedy Jr. dropped a WARHEAD on Dem Rep. Frank Pallone, setting the room ablaze.
🔥 Secretary Kennedy: ⬇️
x.com/VigilantFox/status/19375…
When someone testifying makes a factual statement, how is it that the Chairman of the ocmmittee can have the person testifying retract that statement.
Imagine me saying so and so was caught red-handed attemptin to rape anoterh person and the chairperson instructing me to retract that factual statement.
Seven Things to Know About ProPublica’s Investigation of the FDA’s Secret Gamble on Generic Drugs
ProPublica offers this succinct summary of its investigation on the FDA's secret gamble on poorly performing generic drug makers.
peoplespharmacy.com/articles/s…
Salt Matters: Hidden Perils of Antidepressants and Drug-Induced Hyponatremia
Dangerously low sodium levels can kill! Medications for hypertension, heartburn and depression can cause drug-induced hyponatremia. Beware!
The decision nullifies a treaty designed to protect immigrants from torture.Ian Millhiser (Vox)
As of this moment, Iran, Israel, and the U.S.Jeremy Scahill (Drop Site News)
Bill Melugin
@BillMelugin_
EXCLUSIVE: Per federal sources, the vice mayor of Cudahy, a city in southeast LA County, is under FBI investigation after she allegedly posted a video to social media in which she appears to call for 18th Street & Florencia 13 gang members in LA to defend their territory from ICE, even urging gang leadership to “get your fucking members in order”. ⬇️
x.com/BillMelugin_/status/1937…
According to NATO, Russia has reached a casualty rate of over one million in its war against Ukraine, indicating a continued high tolerance for losses.Ivan Khomenko (UNITED24 Media)
Israel has been exposed as a dependent colony that relies on the West for its military adventures. And even still, it has failed to turn this advantage over Iran into strategic success. The Israel doctrine appears to be meeting its limits.
It's no surprise that Stephen Miller owns a large stake in Palantir, but it's not just about getting rich - the Trump administration marks a coming together a Tech-Right authoritarians and neo-fascists who want ethnic-cleansing.
We mapped out these ideologies here: itsgoingdown.org/good-night-te…
On January 20th, at a ceremony attended by both far-Right and neo-fascist leaders from around the globe and some of the richest tech billionaires in the world, including the heads of Apple, Google,...It's Going Down
An anonymous reader quotes a report from Transport Topics: A ship that caught fire in the Pacific Ocean earlier this month has sunk. The vessel was abandoned in the middle of the pacific -- about 360 miles from land -- after a blaze.tech.slashdot.org
NEW: "If ICE is holding 59,000 immigrants in civil detention across the country, it would be the highest number on record that I'm aware of," said Austin Kocher, a professor at Syracuse University who studies the U.S. immigration system.
cbsnews.com/news/ice-record-59…
U.S. Immigration and Customs Enforcement is holding around 59,000 detainees in facilities across the country, likely setting a record high, according to internal government data obtained by CBS News.Camilo Montoya-Galvez (CBS News)
XBOW, an autonomous penetration tester, has reached the top spot on HackerOne
Link: xbow.com/blog/top-1-how-xbow-d…
Discussion: news.ycombinator.com/item?id=4…
For the first time in bug bounty history, an autonomous penetration tester has reached the top spot on the US leaderboard.xbow.com
DEAR FRIENDS. IF YOU LIKE THIS TYPE OF CONTENT, SUPPORT SOUTHFRONT WORK :Odysee
Édifice bien connu, le long du Canal Lachine
Réjean Leroux 2025
Photo du 29-07-2018 — #mywork, #myphoto, #photo, #photographie, #photography, #foto #amateur, #couleur, #gimp, #Montréal, #architecture
like this
messidor_, yvad, Indiefotog, Nudist Awareness, dieter_wilhelm, Damien Tron, Miguela and Kristian like this.
Pacomm reshared this.
Sensitive content
The headline included "influencer" which I generally could care less about. Clicked anyway--and aw, shit. Too fucking soon. What a lovely human she was. Goddammit. There's SO many other people that SHOULD be dead. Not her.
the-independent.com/life-style…
Wildlife rescuer has been remembered as a ‘superhero’ who saved hundreds of animalsEllie Muir (The Independent)
Sensitive content
Bullied to death??
Fucking hell.
my gut feeling is without an assessment on site nobody can say for sure whether these facilities were destroyed or damaged and to what extent.
3x MOP bombs, with the ability to penetrate 18 meters of reinforced concrete, in close to the same location in succession, vs 90m of rock, dirt and some amount of reinforced concrete above the facility.
i think it depends a lot on the composition and stability of the rock above the facility and how reinforced the structure was, and how well timed the blasts were, the angle and some other variables.
you need someone on the ground to assess the extent of the damage, so i call BS on the CNN report and also on trump's claim that it was totally obliterated, until someone has proof one way or another.
like this
clarice overhere, Sunyata ☸ 👨🏻💻 ☮, thierry 3b2, dieter_wilhelm and hummingbird like this.
nowisthetime reshared this.
Lyon abandonne Microsoft office pour renforcer sa « souveraineté numérique » - Next
La Ville de Lyon va progressivement remplacer la suite Microsoft par des logiciels bureautiques libres, dont « Only Office pour la bureautique, ainsi que Linux et PostgreSQL pour les systèmes et bases de données ».
next.ink/brief_article/lyon-ab…Lyon abandonne Microsoft office pour renforcer sa « souveraineté numérique » - Next
La Ville de Lyon va progressivement remplacer la suite Microsoft par des logiciels bureautiques libres, dont « Only Office pour la bureautique, ainsi que Linux et PostgreSQL pour les systèmes et bases de données ».Next
like this
redj 18, Anne, qlod and Laurent Espitallier like this.
the art of life is not to let the doors that have slammed shut
distract us from the doors that have just opened
Iran und Israel verbindet eine tiefe Feindschaft. Doch stimmt das Narrativ der Vernichtungsdrohung? Eine Analyse zeigt: Übersetzungsfehler spielen eine wichtige Rolle.Luca Schäfer (heise online)
Sensitive content
DEAR FRIENDS. IF YOU LIKE THIS TYPE OF CONTENT, SUPPORT SOUTHFRONT WORK :Odysee
foxnews.com/opinion/gregg-jarr…
static-assets-1.truthsocial.co…
We're in the middle of a legal power struggle between Trump and California Gov. Newsom as judge blocks deployment of National Guard troops sent to quell anti-ICE riots in Los Angeles.Gregg Jarrett (Fox News)
Fight the Proscription of Palestine Action
crowdjustice.com/case/palestin…
Palestine Action has instructed lawyers who will fight against the Home Secretary's attempt to ban our movement.
Contribute to the legal fundraiser to help us stop the proscription.
A direct action network crowdfunding to fight proscriptionCrowdJustice
Kraft Heinz and General Mills announced Tuesday that they plan to remove artificial dyes from their food products by the end of 2027.Mary Walrath-Holdridge (USA TODAY)
the heiress of the Heinz company married John Kerry the democrat bigwig
Blog post on the topic: Broken Fediverse
battlepenguin.com/tech/the-bro…
written by @djsumdog
Good summary of the situation. Also glad that he mentioned alternatives like Nostr
When Elon Musk originally bought Twitter, a number of people moved over to Mastodon. There were a lot of misunderstandings around how Mastodon works....battlepenguin.com
xianc78 reshared this.
🤙🏻 from the nostrverse
Do you have a npub / nostr profile as well?
Yes
npub1hrjtmuryqz82hxzpvv5ulrcxxgrw42afax8n7d9cnnz0zrrq44tqpv3ft3
youtu.be/odphRht6aok?si=hTY4G6…
#ElectronicIntifada #PalestineAction #HudaAmmori #MaxGeller #Palestine #DirectAction #activism
We speak to to returning guests Huda Ammori and Max Geller from Palestine Action.Actionists, as members of the direct action group call themselves, deliberat...YouTube
Gary Hill likes this.
Actionists released after they shut down Shenstone's Israeli weapons factory — all in a day's work
Source: https://x.com/Pal_action/status/1862245804343230812
Gary Hill likes this.
youtu.be/y3Ga4DiV7eM?si=u83-0r…
#PalestineAction #activism #Palestine
To mark a year of genocide in Gaza, we publish this powerful interview with two Israeli dissidents who took part in a Palestine Action siege of the Elbit HQ....YouTube
Gary Hill likes this.
they are not really concerned about Iranian sleeper cells
it is just another fear bomb they throw into society to destabilize it, the communist pathway to power
presstv.ir/Detail/2024/12/21/7…
#PalestineAction #activism #Palestine
In today’s show, we’ll be exploring how Palestine Action’s activities have struck another costly blow against the Israeli arms manufacturer, Elbit Systems.PressTV
Gary Hill likes this.
BREAKING: Palestine Action Scotland destroyed the electricity supply to Leonardo's Edinburgh weapons factory, disrupting the production of laser targeting systems for Israel's F-35 fighter jets.
Source: Pal_action on x/twitter
Gary Hill likes this.
After an action and subsequent correspondence, Hinks Haulage will refuse to take work from Israel's biggest weapons producer and Howmet Aerospace, suppliers of F-35 fighter jet parts.After their quick response to our campaign, they are now no longer a target.
--- Pal_action on x/twitter
Gary Hill likes this.
youtu.be/mJLldwhc3A4?si=baZlwo…
Juries are a microcosm of democracy. Permitted to hear the evidence, they regularly acquit those who act to protect life. Oil and arms industry lobbyists are...YouTube
Gary Hill likes this.
Clerk takes a Clojure namespace and turns it into a notebook.clerk.vision
An IT security guy at a place I once worked said the executives were the biggest security vulnerability the company had because they wanted what they wanted and didn't care much about security. I think that's what tool Maersk down a few years ago - some exec installed malware that spread to the entire network.
"they normally put big all caps bold red warning if the person is a VIP, eg C suite, so they get VIP service - ie anything goes."
Okay, why is every right winger allowed to criticize Israel all of a sudden?👈🏻
Star Of Remphan Or Seal Of Solomon?
Alex Jones Reveals The True Origin Of Modern Israel's So-Called Star Of David
Not sure. It certainly was not acceptable to criticize them a few years ago.
If I remember correctly, Alex Jones tip toed around the Israel issue for about a decade. I have seen earlier videos where he had criticisms.
youtu.be/AzrFiLo4y6A?si=CsrSPq…
#MohammadMarandi #propaganda #WesternMedia #Iran
As tensions escalate between Israel and Iran, Iranian analyst Mohammad Marandi exposes how Western media — even so-called progressive outlets like Democracy ...YouTube
SANAA, June 24 (YPA) - Head of the Sanaa negotiating delegation, Mohammed Abdul-Salam, praised the great stance and sacrifices made by Iran's leadership, people, and army during the 12-day war with the Israeli enemy.In a post on X, he emphasized thatاحسن (Yemen Press Agency)
UPDATE: NARA has taken this down/rescinded, and stated that it had "many inaccuracies."
This is NOT GOOD. #archives "
Restricted-Access Federal Facility, Effective July 7, 2025
Effective July 7, 2025, the National Archives at College Park, MD, will become a restricted-access federal facility with access only for visitors with a legitimate business need. It will no longer be open to the general public." archives.gov/college-park
We hold permanent records created by Federal agencies that include: Textual records from civilian agencies Army unit records dating from WW1 Navy unit records dating from WW2 Still pictures Electronic records Cartographic and architectural holdings …The National Archives at College Park, Maryland
People keep telling me that X11 doesn’t support DPI scaling, or fractional scaling, or multiple monitors, or something. There’s nothing you can do to make it work. I find this surprising. Why doesn’t it work? I figure the best way to find out is try the impossible and see how far we get.
I’m just going to draw a two inch circle on the screen. This screen, that screen, any screen, the circle should always be two inches. Perhaps not the most exciting task, but I figure it’s isomorphic to any other scaling challenge. Just imagine it’s the letter o or a button we wish to draw at a certain size.
I have gathered around me a few screens of different sizes and resolutions. My laptop screen, and then a bit to the right a desktop monitor, and then somewhere over that way a nice big TV. Specifically:
$ xrandr | grep \ connected
eDP connected primary 2880x1800+0+0 (normal left inverted right x axis y axis) 302mm x 189mm
DisplayPort-0 connected 2560x1440+2880+0 (normal left inverted right x axis y axis) 590mm x 334mm
DisplayPort-1 connected 3840x2160+5440+0 (normal left inverted right x axis y axis) 1600mm x 900mmI think I just spoiled the ending, but here we go anyway.
I’m going to draw the circle with OpenGL, using a simple shader and OBT. There’s a bunch of not very exciting code to create a window and a GLX context, but eventually we’re going to be looking at the shader. This may not be the best way to draw a circle, but it’s my way. For reference, the full code is in circle.c.
<span class=tp>void</span> main<span class=st>(</span><span class=st>)</span>
<span class=st>{</span>
float thick <span class=op>=</span> radius <span class=op>/</span> <span class=nm>10</span>;
<span class=kw>if</span> <span class=kw>(</span>abs<span class=cm>(</span>center<span class=op>.</span>y <span class=op>-</span> gl_FragCoord<span class=op>.</span>y<span class=cm>)</span> <span class=op><</span> thick<span class=op>/</span><span class=nm>2</span><span class=kw>)</span>
thick <span class=op>=</span> <span class=nm>2</span>;
float pi <span class=op>=</span> <span class=nm>3</span><span class=op>.</span><span class=nm>14159</span>;
float d <span class=op>=</span> distance<span class=kw>(</span>gl_FragCoord<span class=op>.</span>xy<span class=op>,</span> center<span class=kw>)</span>;
float angle <span class=op>=</span> atan<span class=kw>(</span>gl_FragCoord<span class=op>.</span>y <span class=op>-</span> center<span class=op>.</span>y<span class=op>,</span> gl_FragCoord<span class=op>.</span>x <span class=op>-</span> center<span class=op>.</span>x<span class=kw>)</span>;
angle <span class=op>/=</span> <span class=nm>2</span> <span class=op>*</span> pi;
angle <span class=op>+=</span> <span class=nm>0</span><span class=op>.</span><span class=nm>5</span>;
angle <span class=op>+=</span> <span class=nm>0</span><span class=op>.</span><span class=nm>25</span>;
<span class=kw>if</span> <span class=kw>(</span>angle <span class=op>></span> <span class=nm>1</span><span class=op>.</span><span class=nm>0</span><span class=kw>)</span> angle <span class=op>-=</span> <span class=nm>1</span><span class=op>.</span><span class=nm>0</span>;
float amt <span class=op>=</span> <span class=kw>(</span>thick <span class=op>-</span> abs<span class=cm>(</span>d <span class=op>-</span> radius<span class=cm>)</span><span class=kw>)</span> <span class=op>/</span> thick;
<span class=kw>if</span> <span class=kw>(</span>d <span class=op><</span> radius <span class=op>+</span> thick && d <span class=op>></span> radius <span class=op>-</span> thick<span class=kw>)</span>
fragment <span class=op>=</span> vec4<span class=kw>(</span>rgb<span class=cm>(</span>angle<span class=cm>)</span><span class=op>*</span>amt<span class=op>,</span> <span class=nm>1</span><span class=op>.</span><span class=nm>0</span><span class=kw>)</span>;
<span class=kw>else</span>
discard;
<span class=st>}</span>I got a little carried away and made a pretty color wheel instead of a flat circle.
The key variable is radius which tells us how many pixels from the center the circle should be. But where does the shader get this from?
glUniform1f(0, radius);Okay, but seriously. We listen for configure events. This is the X server telling us our window has been moved or resized. Something has changed, so we should figure out where we are and adjust accordingly.
<span class=kw>case</span> ConfigureNotify<span class=op>:</span>
<span class=st>{</span>
XConfigureEvent <span class=op>*</span>xev <span class=op>=</span> <span class=kw>(</span><span class=tp>void</span> <span class=op>*</span><span class=kw>)</span>&ev;
<span class=tp>int</span> x <span class=op>=</span> xev<span class=op>-></span>x;
<span class=kw>for</span> <span class=kw>(</span><span class=tp>int</span> i <span class=op>=</span> <span class=nm>0</span>; i <span class=op><</span> <span class=nm>16</span>; i<span class=op>++</span><span class=kw>)</span> <span class=kw>{</span>
<span class=kw>if</span> <span class=cm>(</span>x <span class=op>>=</span> screen_x<span class=bi>[</span>i<span class=bi>]</span> && x <span class=op>-</span> screen_x<span class=bi>[</span>i<span class=bi>]</span> <span class=op><</span> screen_w<span class=bi>[</span>i<span class=bi>]</span><span class=cm>)</span> <span class=cm>{</span>
float r <span class=op>=</span> screen_w<span class=bi>[</span>i<span class=bi>]</span> <span class=op>/</span> screen_mm<span class=bi>[</span>i<span class=bi>]</span> <span class=op>*</span> <span class=nm>25</span><span class=op>.</span><span class=nm>4</span>;
<span class=kw>if</span> <span class=bi>(</span>r <span class=op>!=</span> radius<span class=bi>)</span> <span class=bi>{</span>
radius <span class=op>=</span> r;
<span class=bi>}</span>
<span class=kw>break</span>;
<span class=cm>}</span>
<span class=kw>}</span>
width <span class=op>=</span> xev<span class=op>-></span>width;
height <span class=op>=</span> xev<span class=op>-></span>height;
<span class=st>}</span>Getting closer. The numbers we need come from the X server.
XRRScreenResources <span class=op>*</span>res <span class=op>=</span> XRRGetScreenResourcesCurrent<span class=st>(</span>disp<span class=op>,</span> root<span class=st>)</span>;
float screen_mm<span class=st>[</span><span class=nm>16</span><span class=st>]</span> <span class=op>=</span> <span class=st>{</span> <span class=nm>0</span> <span class=st>}</span>;
float screen_w<span class=st>[</span><span class=nm>16</span><span class=st>]</span> <span class=op>=</span> <span class=st>{</span> <span class=nm>0</span> <span class=st>}</span>;
float screen_x<span class=st>[</span><span class=nm>16</span><span class=st>]</span> <span class=op>=</span> <span class=st>{</span> <span class=nm>0</span> <span class=st>}</span>;
<span class=tp>int</span> j <span class=op>=</span> <span class=nm>0</span>;
<span class=kw>for</span> <span class=st>(</span><span class=tp>int</span> i <span class=op>=</span> <span class=nm>0</span>; i <span class=op><</span> res<span class=op>-></span>noutput; i<span class=op>++</span><span class=st>)</span> <span class=st>{</span>
XRROutputInfo <span class=op>*</span>info <span class=op>=</span> XRRGetOutputInfo<span class=kw>(</span>disp<span class=op>,</span> res<span class=op>,</span> res<span class=op>-></span>outputs<span class=cm>[</span>i<span class=cm>]</span><span class=kw>)</span>;
screen_mm<span class=kw>[</span>j<span class=op>++</span><span class=kw>]</span> <span class=op>=</span> info<span class=op>-></span>mm_width;
<span class=st>}</span>
j <span class=op>=</span> <span class=nm>0</span>;
<span class=kw>for</span> <span class=st>(</span><span class=tp>int</span> i <span class=op>=</span> <span class=nm>0</span>; i <span class=op><</span> res<span class=op>-></span>ncrtc; i<span class=op>++</span><span class=st>)</span> <span class=st>{</span>
XRRCrtcInfo <span class=op>*</span>info <span class=op>=</span> XRRGetCrtcInfo<span class=kw>(</span>disp<span class=op>,</span> res<span class=op>,</span> res<span class=op>-></span>crtcs<span class=cm>[</span>i<span class=cm>]</span><span class=kw>)</span>;
screen_w<span class=kw>[</span>j<span class=kw>]</span> <span class=op>=</span> info<span class=op>-></span>width;
screen_x<span class=kw>[</span>j<span class=op>++</span><span class=kw>]</span> <span class=op>=</span> info<span class=op>-></span>x;
<span class=st>}</span>It’s somewhat annoying that physical width and virtual width are in different structures, and we have to put the puzzle back together, but there it is.
Some more code to handle expose events, the draw loop, etc., and that’s it. A beautiful circle sized just right. Drag it over onto the next monitor, and it changes size. Or rather, it maintains its size. Send it over to the next monitor, and same as before.
Time for the visual proof. A nice pretty circle on my laptop. Another circle on my monitor. And despite the 4K resolution, a somewhat pixely circle on my TV. Turns out the hardest part of this adventure was trying to hold an uncooperative tape measure in place with one hand while trying to get a decent, or not, photo with the other.
We were so close to perfection. Somebody at the factory screwed up, and my TV is actually 66.5” wide, not the claimed 63 inches. So if we learn anything today, it’s that you shouldn’t use a consumer LG TV for accurately measuring the scale of structural engineering diagrams, at least not without further calibration.
The good news is we’ve done the impossible. Even better, I didn’t mention that I wasn’t actually running this program on my laptop. It was running on my router in another room, but everything worked as if by MIT-MAGIC-COOKIE-1. Alas, we are still no closer to understanding why people say this is impossible.
Anyway, I think the point is we should probably ignore the people who can’t do something when they tell us we can’t do it either. I woke up this morning not knowing precisely how to draw a scaled circle, having never done so before, but armed with a vague sense that surely it must be possible, because come on of course it is, I got it working. And now look at me, driven insane by the relentless stare of three unblinking eyes.
With my new knowledge, I also wrote an onscreen ruler using the shape extension. Somewhat tautological for measuring the two inch circle, but in the event anyone asks, I can now tell them my terminal line height is 1/8”, and yes, I measured.
Forbidden secrets of ancient X11 scaling technology revealed
Link: flak.tedunangst.com/post/forbi…
Discussion: news.ycombinator.com/item?id=4…
DragonForce Ransomware Cartel are claiming credit for attacks on Marks and Spencer, Co-op and Harrods and say more victim orgs are coming bloomberg.com/news/articles/20…
The UK supermarket chain Co-op said hackers were able to access and extract customer data from one of its systems during a recent cyberattack.Ryan Gallagher (Bloomberg)
I'm going to make this the new ongoing megathread for DragonForce Ransomware Cartel's attack on UK retailers as they're all connected.
Why it matters: these are some of the UK's largest retailers, think Target or some such in a US sense.
Prior threads
M&S: cyberplace.social/@GossiTheDog…
Co-op: cyberplace.social/@GossiTheDog…
Harrods:
cyberplace.social/@GossiTheDog…
Attached: 1 image Co-op Group have shut down some systems due to a cyber incident, however retail stores are still trading uninterrupted (which is core to their business).Cyberplace
The individuals operating under the DragonForce banner are using social engineering for entry.
Defenders should urgently make sure they have read the CISA briefs on Scattered Spider and LAPSUS$ as it's a repeat of the 2022-2023 activity.
Links: cisa.gov/sites/default/files/2…
cisa.gov/sites/default/files/2…
I would also suggest these NCSC guides on incident management: ncsc.gov.uk/collection/inciden…
and effective cyber crisis comms: ncsc.gov.uk/guidance/effective…
Co-op Group have now admitted a significant amount of member (customer) information has been stolen by DragonForce Ransomware Cartel, saying they "accessed data relating to a significant number of our current and past members" - around 20 million people. The Membership database, basically. That includes home addresses and phone numbers etc.
Up until now Co-op hadn't even used the words cyber or threat actor, referring to an "IT issue" and "third party" in comms.
bbc.co.uk/news/articles/crkx3v…
The firm previously said there was "no evidence that customer data was compromised".Joe Tidy (BBC News)
for someone who is unfamiliar with the UK retail market, do you happen to know if Co-op is at all related to the Swedish company Coop that suffered from a major ransomware attack a couple of years ago?
bbc.com/news/technology-577075…
Some 500 stores are forced to close due to the ripple effects of a major cyber attack in the US.Joe Tidy (BBC News)
New by me - breaking down the attacks on UK highstreet retailers
doublepulsar.com/dragonforce-r…
The individuals operating under the DragonForce banner and attacking UK high street retailers are using social engineering for entry. I think it’s in the public interest to break down what is…Kevin Beaumont (DoublePulsar)
Regarding IOCs around the UK retailer activity - there’s loads doing the rounds, and they’re almost all not useful.
Eg hundreds of dynamic VPN IPs from 2022. If you google them you’ll find them on vendor blogs from years ago for Scattered Spider - people are recycling in panic and passing around in panic.
Don’t hunt on random IOCs. IP addresses change. Strengthen foundational controls. Review sign in logs for abnormal activity etc.
Orgs need to review their password reset process, share awareness to individuals who conduct password reset requests (IT helpdesk).
No IOC will help you identify social engineering activity.
UK cyber security at private firms tends to be very poor on average but social engineering remains the hacker's most effective tool.
Slack and Teams access in particular seems like a large attack vector. I believe the Twitter hack a few years back - when it was Twitter - was facillitated by superuser creds being pinned to a slack channel.
One of M&S’ biggest suppliers have said they have reverted to pen and paper for orders due to M&S lacking IT.
Additionally, M&S staff are raising concern about how they will be paid due to lack of IT systems.
M&S are over a week into a ransomware incident and still don’t have their online store working.
bbc.com/news/articles/cvgnyplv…
What's going on behind the scenes in the aftermath of the cyber attack on M&S.Emma Simpson (BBC News)
Rebuilding business is prioritised by importance. If the online shop is a small side hustle compared to the brick&mortar ones (or is much slower), then it’s lower priority.
Communicating the current status and expected progress is better, builds trust.
Wages usually are handled as lump payment, i.e. the same sum as last mont - and corrected later when the HR systems are back online.
The incidence response team should cover IT forensics, BCM and communication.
Mr. Rumbold is sure going to be busy…
Here's the ITV News report anyhoo, logline: "ITV News understands the the ongoing cyberattack faced by the supermarket has worsened since Friday, impacting the ordering system, drivers and warehouse staff."
Sunday Times has a piece looking into ransomware incident at Marks and Spencer. It's pretty good, goes into their contain and eradicate focus.
"By shutting down parts of the IT estate, Higham’s team had worked to prevent the attack from spreading, but had also stopped parts of its digital operations from functioning. This was considered a worthy trade-off."
One error in the article - lack of recovery doesn't mean no ransomware paid. Paying is not quick restoration.
thetimes.com/business-money/co…
Icare4America reshared this.
There’s a piece in The Sunday Times today about the DragonForce ransomware incident at Marks and Spencer which caught my eye. It’s a great piece, e.g. it looks at M&S containing the threat to…Kevin Beaumont (DoublePulsar)
Great NCSC piece by @ollie_whitehouse
I’d add - block by Entra policy specifically High risk logins (below is too FP prone), and SOC monitor them. SOC playbook = account probably compromised. How?
Sky News quote a source in M&S head office saying Marks and Spencer have no ransomware incident plan so they are making it up as they go along apparently, with staff sleeping in the office and communicating via WhatsApp.
M&S dispute this, saying they have robust business continuity plans.
news.sky.com/story/amp/mands-h…
A source describes chaotic scenes - as hackers continue to hold the High Street company to ransom.Tom Cheshire (Sky News)
The NCSC urges firms to check IT help desk "password reset processes" as hackers target retailers.Joe Tidy (BBC News)
Co-op Group appear to be trying to course correct with their cyber incident comms.
They’re calling it a cyber incident now, and have put a statement on the front page of their website, along with an FAQ. They haven’t yet emailed members (they should). Edit: they’ve started emailing members.
Stores display handmade signs to warn customers they can only pay in cash after hackers hit retailerDaniel Woolfson (The Telegraph)
People are also taking to social media to post pictures of apparently emptying store shelves.
The Co-op website claims it is down to "technical issues".
Co-op Group are redirecting supplies from their urban stores to remote and island locations due to stock shortages.
The article mentions their EDI platform is suffering “technical issues”. retailgazette.co.uk/blog/2025/…
The Co-op is redirecting food and drink supplies to stores in rural and remote areas in a bid to protect isolated communities from shortages following a serious cyber attack.Georgia Wright (Retail Gazette)
I just did a Shodan Safari on Co-op - basically all their Windows and Linux systems in their core DCs at network boundary are down, it's not just EDI. It's been like that for just under a week, prior to that things were still online.
I feel really bad for them as it's a great org. Also their CEO is basically the only one who stood up like this for trans people.
telegraph.co.uk/business/2025/…
Interview: Shirine Khoury-Haq says non-binary people bring a ‘massive business benefit’Hannah Boland (The Telegraph)
If you're wondering about Marks and Spencer - I just did a Shodan Safari of their network boundary, Palo-Alto GlobalProtect VPN remote access access is still offline, 15 days later.
Online orders are still not working, and the store stock checker is disabled now.
Co-op has paused its orders of non-essential products amid the fallout from its cyber attack.Eloise Hill (Retail Gazette)
Marks & Spencer enters the third week of its ecommerce platform suspension today (9 May), as the retailer continues to battle a cyber-attack.Sabina Weston (Drapers)
The Grocer reports 4 regional Co-ops, who aren’t part of Co-op Group, are suffering stock shortages as they are supplied by Co-op Group.
They expect customers to start to see availability issues on shelves in the coming days.
thegrocer.co.uk/news/co-op-soc…
Midcounties Co-op, Heart of England Co-op and Lincolnshire Co-op have all confirmed disruption to the supply of food to storesAlice Leader (The Grocer)
For orgs looking for defence tips for the attacks on UK retailers, this blog from 2022 about the UK teenagers in LAPSUS$ has relevance.
As a plot twist - not documented anywhere online, but LAPSUS$ first attacks in 2021 were against UK high street retailers.
microsoft.com/en-us/security/b…
The activity we have observed has been attributed to a threat group that Microsoft tracks as DEV-0537, also known as LAPSUS$. DEV-0537 is known for using a pure extortion and destruction model without deploying ransomware payloads.Microsoft Threat Intelligence (Microsoft Security Blog)
M&S bureau de change staff are being forced to use pen and paper to serve customers. The travel money desks are also unable to accept card payments in some cases.John-Paul Ford Rojas (This Is Money)
Co-op Group have provided some more detail about what it’s doing about remote lifeline stores (ones where they’re the main/only retailer on an island):
“From Monday, 12 of the most remote lifeline stores will receive treble the volume of available product, and another 20 lifeline stores will get double the volume.” bbc.com/news/articles/c071e7x8…
The picturesque island of Islay in the Western Isles is dealing with the real world impacts of the major supermarket hack.Paul Ward and Lorna Gordon (BBC News)
Explore exciting job opportunities at M&S across various sectors: In-Store, Digital & Tech, Clothing, Food, Support, and Logistics. Be part of Britain's best-loved brand, championing sustainability, inclusion, and innovation.jobs.marksandspencer.com
U.K. retailer the Co-op is still having trouble with keeping grocery shelves stocked as it continues to respond to an attempted cyberattack that forced it to shut down some systems two weeks ago.Alexander Martin (The Record)
The Willis-brokered coverage also includes the Willis CyXS facility.Abbie Day (Insurance Insider)
This ITV News report linking the Co-op and M&S breaches to SIM swapping is not accurate, no source given. itv.com/news/2025-05-12/sim-sw…
They also have a report today saying Co-op stores are restocked, which is also not accurate - that one is sourced from Co-op, but obviously doesn’t stack up to looking in Co-op stores.
If anybody is wondering, all of Marks and Spencer's Palo-Alto GlobalProtect VPN boxes are still offline, 3 weeks later. Pretty good containment method to keep attackers out.
Co-op's VDE environment is still down, too.
cyberplace.social/@GossiTheDog…
Attached: 1 image M&S use Palo-Alto GlobalProtect for VPN, they took all the endpoints offline days ago (usually first stage containment for ransomware/extortion groups).Cyberplace
The retail giant is still not taking online orders following a cyber attack three weeks ago.Michael Race & Joe Tidy (BBC News)
Co-op's AGM is this weekend, and M&S yearly results and investor contact are next week.
Gonna be awkward for different reasons, e.g. Co-op is member (customer) owned, so the people's data Co-op had stolen are effectively the shareholders and are invited.
Bosses expect "steady improvements each day", after a cyber attack leads to empty shop shelves.Caitlin Klein (BBC News)
The Grocer reports Nisa and Costcutter are running out of fruit & veg, fresh meat and poultry, dairy products, chilled ready meals, snacks and desserts.
Nisa and Costcutter are supplied by Co-op Wholesale, which is dependent on Co-op Group.
“It’s really poor. I feel bad for them but what makes it worse is their hush-hush mentality about it. There’s no proper level of communication and we get random updates.”
Co-op Wholesale claim there are no problems. thegrocer.co.uk/news/nisa-and-…
In communications sent to retailers, the symbol groups listed products that were either ‘temporarily unavailable’ or ‘out of stock’ as a result of supplier issuesAlice Leader (The Grocer)
Co-op Group have told their suppliers that "systemic-based orders will resume for ambient, fresh, and frozen products commencing Wednesday 14 May". They say forecasting system will still be impacted.
thegrocer.co.uk/news/co-op-to-…
As the Co-op turns orders back online, it has warned suppliers that it is unable to provide ‘accurate product forecasting ahead of Wednesday’s orders’Alice Leader (The Grocer)
UK retailer to file big claim as it admits for first time that some customer data was stolen in recent hackLaura Onita (Financial Times)
Co-op Group say they have exited containment and begun recovery phase theguardian.com/business/2025/…
Marks and Spencer are still in containment
If you want figures for your board to set expectations in big game ransomware incidents, Co-op containment just over 2 weeks, M&S just over 3 weeks so far - recovery comes after.
In terms of external assistance, Co-op have Microsoft Incident Response (DART), KPMG and crisis comms. M&S have CrowdStrike, Microsoft, Fenix and crisis comms.
Group in ‘recovery phase’ and working closely with suppliers after customers complain of empty shelvesSarah Butler (The Guardian)
The threat actor at Co-op says Co-op shut systems down, which appears to have really pissed off the threat actor. This was the right, and smart, thing to do.
While I was at Co-op we did a rehearsal of ransomware deployment on point of sale devices with the retail team, and the outcome was a business ending event due to the inability to take payments for a prolonged period of time. So early intervention with containment was the right thing to do, 100%.
bbc.co.uk/news/articles/cwy382…
The revelation - from the criminals responsible - explains why the Co-op is getting back to business faster than M&S.Joe Tidy (BBC News)
M&S have finally told staff that data about themselves was stolen: telegraph.co.uk/business/2025/…
You may notice I said they had staff data stolen on May 9th in this thread.
Employees’ email addresses and full names have been taken by hackers, sources claimMatthew Field (The Telegraph)
For the record, the tools listed in this article aren't used by Co-op.
computing.co.uk/news/2025/secu…
The link in the article to Vectra Cognito AI has a Coop Sweden logo on it, and the Coop Sweden CISO is named. Coop Sweden is different company. Coop Sweden went on to have a ransomware attack that crippled the org, including point of sale, so I don't think it's a good sales point. Same with Silverfort.
Google AI has ingested the article and now uses it to claim Co-op Group use the tools.
Computing research has identified the security tools and partners the Co-op used to stop last month’s cyberattack in its tracks.www.computing.co.uk
Stuart Machin’s awards set to shrink after UK retailer’s share price drops following disclosure of sweeping hackLaura Onita (Financial Times)
The Times reports M&S were breached through a contractor and that human error is to blame. (Both M&S and Co-op use TCS for their IT Service Desk).
The threat actor went undetected for 52 hours. (I suspect detection was when their ESXi cluster got encrypted).
M&S have told the Times they had no “direct” communication with DragonForce, which is code for they’re using a third party to negotiate - standard practice.
M&S looks to be moving to reposition their incident as a third party failure, which I imagine will help redirect some of the blame (they present their financial results during the week to investors): bbc.co.uk/news/articles/cpqe21…
Both M&S and Co-op outsourced their IT, including their Service Desk (helpdesk), to TCS (Tata) around 2018, as part of cost savings.
The retailer has been struggling to get its services back to normal after a cyber-attack in April.Emma Simpson (BBC News)
There's nothing to suggest TCS itself have a breach btw.
Basically, if you go for the lowest cost helpdesk - you might want to follow the NCSC advice on authenticating password and MFA token resets.
I've put a 3 part deep dive blog series coming out probably next week called Living-Off-The-Company, which is about how teenagers have realised large orgs have outsourced to MSPs who follow the same format of SOP documentation, use of cloud services etc. Orgs have introduced commonality to surf.
The Office of the Privacy Commissioner for Personal Data says M&S Hong Kong has not informed it of a recent customer data leak, nor responded to its enquiries.Tom Grundy (Hong Kong Free Press HKFP)
"Cyber analysts and retail executives said the company had been the victim of a ransomware attack, had refused to pay - following government advice - and was working to reinstall all of its computer systems."
Not sure who those analysts are, but since DragonForce haven't released any data and M&S won't comment other than to say they haven't had any "direct" contact with DragonForce, I wouldn't make that assumption.
There's also a line in the article from an cyber industry person saying "if it can happen to M&S, it can happen to anyone" - it's ridiculous and defeatist given Marks and Spencer haven't shared any technical information about how it happened, other than to tell The Sunday Times it was "human error"
The Air Safety version of cyber industry would be a plane crashing into 14 other planes, and industry air safety people going "Gosh, if that can happen to British Airways it could happen to anybody!"
Tomorrow it’s one month since Marks and Spencer started containment, it’s also their financial results day.
Online ordering still down, all recruitment stopped, Palo-Alto VPNs still offline.
TCS have been linked to the Marks and Spencer breach, at least in part.
reuters.com/business/retail-co…
Customers have been unable to order online for almost a month due to the cyber-attack.Lucy Hooker (BBC News)
The NCA has confirmed on the record that the investigation into the M&S and Co-op hack is focused on English teenagers. I could toot the names of the people I think they’ll pick up, but won’t.
bbc.co.uk/news/articles/ckgnnd…
The National Crime Agency tells the BBC how it is trying to find the culprits of the M&S and Co-op hacks.Joe Tidy (BBC News)
This stuff is brilliant. Based on e-paper and runs on Zigbee.
And they can raise the prices between you picking things off the shelf and going through the checkout and you'll have no proof that it was offered at a lower price.
pssscht. Like that would ever happen lol
bbc.com/news/technology-577075…
Some 500 stores are forced to close due to the ripple effects of a major cyber attack in the US.By Joe Tidy (BBC News)
e-paper price labels are apparently extremely common in mainland Europe. The UK is extremely slow to adopt things like this.
*In theory*, during an incident, the labels would remain as-is until they receive a new price. So TAs would specifically need to target the pricing database prior to wiping.
TCS has a security incident running around the M&S breach.
Interestingly the source claims TCS aren't involved in Co-op's IT - which is categorically false, they took over most of it while I worked there, including the helpdesk, and my team (SecOps) after I left.
ft.com/content/c658645d-289d-4…
Indian IT company investigating whether it was gateway used by criminals to access retailerChris Kay (Financial Times)
Insurance Insider say Co-op Group have no cyber insurance policy.
It’s got the insurance industry hard as they think they can ambulance chase other orgs with it.
insuranceinsider.com/article/2…
While M&S had a cyber policy in place, Co-op and Harrods did not, Insurance Insider revealed.Abbie Day (Insurance Insider)
Ransomware actor exploited RMM to access multiple organizations; Sophos EDR blocked encryption on customer’s networkSophos News
While Co-op have restored every customer facing system and internal systems like recruitment and remote working, M&S still don't even have recruitment back.
I'm reliably told they paid the ransom, so they'll be target #1 basically forever with other ransomware groups now due to resiliency woes and willingness to pay.
Stuart Machin's money is not affected by the IT disruption but it will be considered for next year's pay.BBC News
M&S suspended online recruitment, along with clothing and home orders, after hackers took control of its systems in a cyberattack in AprilSteve Farrell (The Grocer)
This Daily Mail piece about security leaders thinking work-from-home means they will be crippled is horseshit, I'm not linking it.
They've taken a survey about how security people think their businesses couldn't survive ransomware, and linked it to working from home. WFH isn't the problem: business IT and resilience being built on quicksand is the problem.
Looks like a product of the "a good lie contains as much truth as possible" school.
The connection to WFH is spurious; but only two thirds sounds low for "We don't really understand our problems; but they are probably apocalyptic".
The 'WFH' allegations seem in especially bad faith given the suspected entry point for the M&S compromise: the outsourced helpdesk.
Those guys are even more compliant labor than work-not-from-home employees, so the Daily Heil isn't going to say anything; but lack even the (informal; but in practice often at least reasonably effective) "does the IT person you just poked recognize who is interrupting with a password question?" ID verification step with onsite workers and onsite IT.
Co-op say they have largely completed recovery, and have removed the cyber attack banner and statement from their website
retailgazette.co.uk/blog/2025/…
I think they did a great job. They do call it a "highly sophisticated attack", which, frankly.. isn't true and may come out in open court later if the suspects are ever caught.
6 weeks from containment to "near full" recovery, for statto nerds like me who track this stuff.
Co-op has said it’s in a “much stronger position” as store deliveries return to normal following its cyber attack.Aoife Morgan (Retail Gazette)
M&S had their ransomware incident communicated via internal email - from the account of a staff member who works for TCS.
The way TCS work is you give them accounts on your AD.
bbc.co.uk/news/articles/cr58pq…
The criminals told the retailer's boss he could make things "fast and easy" if he complied with their demands.Joe Tidy (BBC News)
Marks and Spencer have started partial online shopping again.
For statto nerds, around 7 weeks from containment to partial recovery
bbc.co.uk/news/articles/c4gevk…
The return of online shopping marks a key milestone for the retailer, which has struggling to get services back to normal.Michael Race (BBC News)
TCS have told shareholders their systems were not compromised in the hack of M&S.
As an explainer here (not in the article): TCS IT systems weren't compromised. Their helpdesk service (they're AD admins at M&S) was used to gain access to M&S. They manage M&S IT systems.
reuters.com/business/media-tel…
Latest Marks and Spencer update is pretty crazy.
M&S haven't been able to supply sales data - so the British Retail Consortium (BRC) - used by the UK government as as economic indicator - basically made up figures for M&S and didn't tell people they had done this.
telegraph.co.uk/business/2025/…
British Retail Consortium published ‘made-up’ sales figures following attack on high street giantHannah Boland (The Telegraph)
I'd be very curious to know what the breakdown is between TCS dropping the ball and lying about it and M&S/Co-op not actually insisting on adequate procedure.
It's not terribly uncommon for people to only care about time-to-resolution with some lip service to user satisfaction when it comes to helpdesk metrics; and tacitly discourage things that are slow and unpleasant like hassling people for ID, at least until that becomes a visibly terrible idea.
"M-SThrowaway" might indicate M&S?
Or is that too obvious or deliberate obfuscation? 🙂🤷♂️
as someone who has been subjected to Tata on multiple occasions going back over a decade?
This isn't nearly spicy enough. I don't even describe them as a 'body shop' because they'd gladly route you to a corpse and try to charge extra for '24x7 coverage.'
When one employer did a basic security audit of their helpdesk services, Tata failed so severely that the contract was pulled for cause before the audit was even completed. They moved it all back in-house.
The root problem here isn't that TCS are shockingly bad (they are, just about everyone knows that).
The root problem is that "management decisions" constantly overrule those that raise concerns about their service and tell any remaining internal IT and security staff to "deal with it as best you can."
I'm very much of the view that, yes, the outsourced provider can be the cause of an incident, they can provide a shockingly bad service, they can cost your business millions of pounds. But the decision to continue to use them when you already know this is a real possibility - that's a decision by senior management within the company. That's on you.
Interesting. I don't have the background on this specific attack, but I'm reminded of the Target credit card theft. An HVAC company near me was the point of entry for the attackers; they had high-access keys to Target's intranet because they install and maintain shopping-mall-grade HVAC and can remote-override it for maintenance and schedule reasons (nation-scale chain stores with giant footprints save not-inconsequential money on things like "Don't power up the HVAC to normal capacity on days nobody is here").
They had the keys on the same machine running their webserver.
(Meanwhile, Target actually did get an SEC slap-on-the-wrist for one specific thing: the HVAC intranet piece wasn't firewalled from the financial transactions and cash register source code pieces).
K. Krithivasan, also known as Krithi, aka the face of quality IT, that you can trust.
Hash tag
These Indian, "IT", call centers probably do double time as scamming operations.
Hilarious twist would be that it was an inside job, faked to look like a compromise.
Marks and Spencer’s CEO says half of their online ordering is still offline after their ransomware incident, they hope to get open in next 4 weeks.
They are also rebuilding internal systems and hope a majority of that will be done by August.
Lesson: mass contain early. M&S didn’t. Co-op did.
17 and two 19 year old teens picked up over Co-op and M&S hacks, and a 20 year old woman.
Pretend to be surprised.
bbc.com/news/articles/cwykgrv3…
Three men and one woman - aged between 17 and 20 - have been arrested in London and the midlands.Joe Tidy (BBC News)
kids these days 🙄
Just stay away from my bins!
. @briankrebs has broken the story that the key member (and teenager) of LAPSUS$ runs Scattered Spider
krebsonsecurity.com/2025/07/uk…
Authorities in the United Kingdom this week arrested four alleged members of "Scattered Spider," a prolific data theft and extortion group whose recent victims include multiple airlines and the U.K. retail chain Marks & Spencer.krebsonsecurity.com
Co-op finally admitted the entire membership database was stolen
I had this in the thread months ago, they originally tried to deny it entirely then tried to say ‘some’ data was accessed when they knew it was the whole thing.
bbc.co.uk/news/articles/cql0pl…
In her first interview since the attack, Co-op's chief executive said she was "incredibly sorry" to customers.Joe Tidy (BBC News)
Personally I think Co-op did a really good job getting out of that situation and minimising impact.
I definitely think if you have a LAPSUS$ style advanced persistent teenagers situation, tilt towards open and honest comms as those kids will use secrecy against ya. It’s 2025, it’s okay to say you got hacked, people largely understand. Also, in IR, lawyers are usually stuck in 1980 advice - it’s just advice, they ain’t yo boss.
It’s 2025, it’s okay to say you got hacked, people largely understand.
Probably the most damning indictment of the entire computing industry that I've seen for a long time.
I don't disagree at all. But this absolutely should not be the case and wouldn't be if we weren't still building core infrastructure around ideas that were known to be bad by the mid 1980s.
The people arrested as part of the Co-op and M&S hack investigation have been released on bail.
nation.cymru/news/four-people-…
Previously when this happened with LAPSUS$, they just continued hacking stuff.
Four young people who were arrested for their suspected involvement in the damaging cyber attacks against Marks & Spencer, the Co-op and Harrods, have been bailed.Emily Price (Nation.Cymru)
at this point I'm much more surprised when someone over 25 gets picked up for hacking stuff, I think some dude was helping gangs smuggle drugs into Rotterdam via hacking into the port logistical systems, they were like 41 with kids, that was way more unexpected to me lol
occrp.org/en/project/narcofile…
Europe’s commercial ports are top entry points for cocaine flooding in at record rates. The work of a Dutch hacker, who was hired by drug traffickers to penetrate port IT networks, reveals how this type of smuggling has become easier than ever.OCCRP
At least the companies used sophisticated defense in depth.
“The BBC later discovered from the criminals that the company disconnected the internet from IT networks in the nick of time to stop the hackers from deploying ransomware and so causing even more disruption.
"Shortly after Co-op announced it had been attacked, luxury retailer Harrods said it too had been targeted and had been forced to disconnect IT systems from the internet to keep the criminals out.”
If it is the case then the leaders of businesses like M&S who outsource these services to the lowest cost providers should also be held to account
It’s typical of British business management to know the cost of technology but not the value of it
In other words, their wetware was targeted.
"Our staff is our most valued asset. We depreciate on it."
The term 'user' in "no TCS systems or users compromised" could be more interesting to argue on in a civil liabilities case.
If a TCS staff member falls for social engineering (even if the action they take is within an assigned M&S tenant account...), is that not the same as a TCS user being compromised?
Anyway... I'm sure that statement won't at all be like rubbing salt in M&S's wounds.
wasn't there some event, maybe 5 years ago, that meant a lot of WFH? Or did I hallucinate those times.
Is it suddenly a problem now or this is the same RTO bullshit being peddled?
Want to guess how much of my IT leadership career has been focused on building in-house expertise and dialing back the presence of MSPs?
Enough that it's made for a pretty good living...
when I got my business degree, one of my management profs said that the instant you outsource, you give up control. To the service provider, you move from income to liability on the balance sheet because you now are costing them money, and to eke out any profit they need to cut costs related to providing service to you.
Thus you get all this *gestures vaguely*
"paints a ticking timebomb" - bit of a mixed metaphor, could be "paints a target" or "plants a ticking timebomb" ? 😎
The shortsightedness of outsourcing everything is undeniable though!
I would love for IT to publish accident investigation reports in the same way as aviation.
No blame, no liability, no finger pointing, just lessons for everyone to learn and hopefully avoid the same.
(I know there have been some like the Irish Health Service that were excellent.)
yeah, breach the "low cost" IT outsourcer - whose staff feel little connection or affinity with the corporate customer - and *bingo* you hit the jackpot 🎰 with multiple corporate accounts to ransom.
How's that "low cost IT outsourcing" looking now?
I recall it was a "TCS_80_ip" list in Entra Id marked "Trusted"/"MFA exempt" that contained 80 ranges from /15 to /24...
Yet happily pivoting through 3 layer deep RDP to get to a system to manage 
“we aren’t a computer company, so off to India / China / Vietnam / Philippines / etc for all this non-core-business shit”
…
“Why company not run without computers? Who did this?”
to be fair, IIRC, Coop Sweden went down because their payment provider used Kaseya.
So, it was ransomware on a fourth party, nothing Coop Sweden had any direct control over
The quote
> They torched shareholder value
made me laugh
they have no idea what the Coop is
the thieves could probably show up at the AGM and present themselves as a member, since they have access to all the information the Co-Op has on it's membership...number, address, etc.
Short of checking govt. ID or requiring a hard copy of the meeting invite that was mailed to their address. Even then, the thieves might've gotten away with that too.
Incident response specialists the world over wince into their keyboards.
This is another object lesson in how not to do it. It'll be taught to students in future.
I can only hope this data breach is the kick up the arse needed to abolish the common practice of using date of birth as an (immutable!) security password. Once it’s public knowledge it’s beyond useless… it’s a liability. Especially in banks.
I will not be holding my breath on this one.
![Dear David,
I'm Jayne Wall, and I look after Customer Service here at M&S. | am sure that you will have seen
in the news that we have been dealing with a cyber incident and | wanted to write to you about
what this means for you.
What has happened?
To proactively manage the incident, we immediately took steps to protect our systems and engaged leading cyber security experts. We also reported the incident to relevant government
authorities and law enforcement, who we continue to work closely with.
Unfortunately, the nature of the incident means that some personal customer data has been
taken, but there is no evidence that it has been shared. The personal data could include
contact details, date of birth and online order history. However, importantly, the data does not
include useable card or payment details, and it also does not include any account passwords.
For more detail, see our FAQs.
How does this affect me and what should | do?
You do not need to take any action, but you might receive emails, calls or texts claiming to be
from M&S when they are not, so do be cautious. Remember that we will never contact you and
ask you to provide us with personal account information, like usernames, and we will never ask you to give us your password.
For more information, FAQs and hints and tips on how to stay safe online visit
corporate.marksandspencer.com/cyber-update
To give you extra peace of mind, next time you visit or login to your M&S.com account on our [truncated]](https://friendica.eskimo.com/photo/preview/640/7778075 "Dear David,
I'm Jayne Wall, and I look after Customer Service here at M&S. | am sure that you will have seen
in the news that we have been dealing with a cyber incident and | wanted to write to you about
what this means for you.
What has happened?
To proactively manage the incident, we immediately took steps to protect our systems and engaged leading cyber security experts. We also reported the incident to relevant government
authorities and law enforcement, who we continue to work closely with.
Unfortunately, the nature of the incident means that some personal customer data has been
taken, but there is no evidence that it has been shared. The personal data could include
contact details, date of birth and online order history. However, importantly, the data does not
include useable card or payment details, and it also does not include any account passwords.
For more detail, see our FAQs.
How does this affect me and what should | do?
You do not need to take any action, but you might receive emails, calls or texts claiming to be
from M&S when they are not, so do be cautious. Remember that we will never contact you and
ask you to provide us with personal account information, like usernames, and we will never ask you to give us your password.
For more information, FAQs and hints and tips on how to stay safe online visit
corporate.marksandspencer.com/cyber-update
To give you extra peace of mind, next time you visit or login to your M&S.com account on our [truncated]")
I was on holidays in Brodick (Arran, Scotland) last sunday, I can confirm the Co-op was low on products, with only potatoes available as fresh vegetables 😬
I though it was because it was a sunday late afternoon, but reading your thread it was clearly linked to the cyber incident
The attack has disrupted deliveries to island communities where Co-op is one of the biggest retailers.BBC News
Not sure if it is related, but M&S shuttered a flag-ship store without notice and earlier than planned on May 7th.
🔗 Marks and Spencer suddenly closes Aberdeen’s flagship St Nicholas branch after more than 80 years in city centre pressandjournal.co.uk/fp/news/…
They've now admitted it -
BBC News - Personal customer data stolen in M&S cyber attack
bbc.com/news/articles/c62v34zv…
The retail giant is still not taking online orders following a cyber attack three weeks ago.Michael Race & Joe Tidy (BBC News)
Well, that's an easy one. Just say that you are calling regarding the reported problem with Outlook.
On the one hand you have a ~90% Chance, that the called person had.a Problem in the last Week, and on the other hand will hand you over the username as well as the password immediately.
I'm somewhat surprised, that this had not been tried earlier.
Huh, might also explain why some of the shelves were so bare at my local yesterday.
(Also, it was a Bank Holiday Monday, but still)
While in #BandQ today, the staff said they'd been having "some IT Issues like M&S"
Not sure if this was the staff just making a parallel of "generic IT issues" or if there has been some incident they haven't admitted yet
Can also confirm, from several years ago, that sometimes there is also an Executive Assistant with a flag in some systems to ‘call on behalf of’ C-Suite/VPs.
It’s like a privilege escalation on people exploit 🤣😂
The cult of “it’s an exec!” and thus able to bypass normal protocols has always made me cry - especially seeing as how they’re the ones with access to the juicy stuff and (usually) have low IT literacy and awareness.
Often, when I’ve worked with an org to help strengthen the help desk, the push back has been from the service desk management (scared that they’ll been seen as impeding the exec in the course of Important Work). Usually asking the question “would you rather be responsible for an extra 60 seconds on a call, or for the entire company being breached?” helps them to see the light.
The other source of friction is from the admin assistants of the execs who seem even more entitled than the execs themselves. An appeal to vanity (“we have to be extra careful when you call in because you’re in a very privileged position”) can work wonders.
Every time I’ve spoken directly with said execs and explained exactly why they are going to be asked to positively ID themselves for any interaction they have been 100% supportive.
This is basically the plan for most businesses in reality.
It's fine to talk about stuff being "widely known best practice," but when IT shows up with big expenses for backups and security, the MBA's always decide it's more important to rightsize the headcount and operate lean. Many IT departments report up through an MBA and not a technical person, and many IT people are terrible at communicating risk dramatically enough to get money.
The thing that gets me is that the two statements are probably true for the people who said them. The Security group may have wargamed and prepared for malware attacks, and done so in a way that no one else in the technical stack even noticed happening (beyond some new agent installs being requested). So when the attack comes, the Security plan swings into action and no one outside of Security knows what it is or has practiced it.
This is high visibility. Executives step in to make Declarations, complicating the response. This is an incident big enough to need sub-commands to track various workflows, reporting up to a rotating incident command. Everyone wants to help, the workflows aren't well defined yet, and people help on their own authority (thanks to Command not having a clear picture yet and guiding where help would be good) and maybe make things worse in a few spots.
We had a plan.
It is chaos.
Both are true.
@ollie_whitehouse
Do egress filtering (esp. for servers) with alerting.
If there is unknown communication, then you have either a misconfiguration or a problem.
Keep critical IT infrastructure (network, firewalls, SAN/NAS, virtualisation, backups) separated from Active Directory.
Do not couple internet-facing systems (including VPN and M365) with your local AD.
I agree with most of your arguments. (In fact, the only one I take exception with is comparing ransomware with climate change. Ransomware is a much more real and urgent problem.) Those are pretty much arguments I've used myself when advising customers hit by ransomware not to pay.
But, ultimately, it's the company's decision. Even if the company makes the wrong decision, the government shouldn't be the one who decides for them.
See also this:
coveware.com/blog/2025/4/29/th…
"Decryption tools are worse than they’ve ever been."
The Ransomware-as-a-service (RaaS) model has not recovered from law enforcement disruption, and the entrance of novice actors along with non-Russian state-linked cybercriminals has led to uncertain outcomes for victims.Bill Siegel (Coveware: Ransomware Recovery First Responders)
Stuart Machin had been looking forward to a long weekend. It was Easter Saturday and the chief executive of Marks & Spencer had retired to his south London home for the evening, after a long day inspecting the aisles of his local M&S branch — somethi…apple.news
Multiple explosions were heard in the Iraqi capital, Baghdad, particularly at Camp Taji, a military installation used by Iraqi and the US-led coalition forces.Al Mayadeen English (Unknown drone attack targets Taji Camp in Baghdad, Iraq)
Sensitive content
YUINA Ema #結菜えま
mastodon.social/@ethal/1146801…
#EmaYUINA #YUINA_Ema #SexyJapanese #SexyAsian #gravure #JAV
Sensitive content
Sensitive content
Sensitive content
Nanook likes this.
Chinese President Xi Jinping will attend a gathering marking the 80th anniversary of the victory in the Chinese People's War of Resistance Against Japanese Aggression and the World Anti-Fascist War.eng.chinamil.com.cn
You can follow us in other languages. Visit our website for more information wordsmith.social/protestation/…
Social
English– @protestation@friendica.eskimo.comFrançais– @protestation@social.trom.tf– @protestation@mastodon.social
Deutsch– @protestation@friendica.opensocial.space
Português– @protestation@mastodon.acc.sunet.se– @protestation@friendicarg.nsupdate.info
Quotes– @protestation@embers.social– @protestation@freeradical.zone
Al-Qassam Brigades, the military wing of the Islamic Resistance Movement (Hamas), announced on Tuesday that its fighters carried out a complex ambush targeting a Zionist force entrenched inside a house south of Khan Younis in the southern Gaza Strip.www.saba.ye
#gaza #palestinian #children #palestine #civilians #siblings #parents #children #loss #suffering #pain #deaths #killings #endisraelswarcrimes #stopisrael #childmurder
This Palestinian boy was #MurderedbyIsrael yesterday.
So‑Called Vaughn
in reply to Dave Goldsmith • • •For anyone wondering about the text:
“CATONSVILLE NINE
ON MAY 17, 1968, NINE CATHOLIC ACTIVISTS RAIDED THE SELECTIVE SERVICE OFFICE IN CATONSVILLE AND BURNED SEVERAL HUNDRED DRAFT FILES TO PROTEST THE VIETNAM MAR. IN A HIGHLY-PUBLICIZED TRIAL, THE "NINE." WHO INCLUDED PRIESTS DANIEL AND PHILIP BERRIGAN, WERE CONVICTED AND SENTENCED TO PRISON. THE CATONSVILLE ACTION PLAYED AN IMPORTANT ROLE IN THE ANTIWAR MOVEMENT, INSPIRING SIMILAR ACTS OF CIVIL DISOBEDIENCE ACROSS THE COUNTRY.
MARYLAND HISTORICAL TRUST
MARYLAND STATE HIGHWAY ADMINISTRATION”
Dave Goldsmith reshared this.
Dave Goldsmith
in reply to So‑Called Vaughn • • •@vaughnsc
Nice move!
So‑Called Vaughn
in reply to Dave Goldsmith • • •