Scattered Spider (UNC3944) affiliates acting as DragonForce ransomware-as-a-service operators conducted a wave of attacks against UK retailers in April–May 2025. Co-op confirmed system disruptions and data exfiltration affecting member and employee data. Harrods confirmed a cyberattack on 1 May 2025 requiring restriction of internet access. Combined financial impact of M&S, Co-op, and Harrods attacks assessed at £270–440 million ($363–592 million). NCA arrested four suspects (three teenagers and one 20-year-old Latvian national) on 10 July 2025. Attacks represent a coordinated Scattered Spider campaign against UK retail using DragonForce RaaS.