Harrods was among the UK retailers targeted in the wave that included Marks & Spencer and the Co-op, and is named among the victims connected to the subsequent arrests filed in 26-0725.
Three prominent retailers in one market, in one window, by one crew. That is a targeting decision worth taking apart.
Sector-Sequential Targeting Is Efficient
Working a single sector concentrates reusable knowledge. Organisations in the same market use the same handful of outsourced service desk providers, the same retail platforms, the same logistics software, and frequently the same consultancies.
A call script refined against one retailer’s outsourced desk is likely to work against another’s, because it may be the same desk. Reconnaissance amortises across targets in a way it does not when an attacker moves between industries.
Which Makes Sector Information Sharing The Counter
If the adversary’s advantage is reuse across peers, the defensive counter is the same reuse in the other direction — and it depends on a retailer telling its competitors what happened, quickly, before the competitors are called.
That is a genuinely hard ask during an active incident, with lawyers advising silence and a market watching. It is also the only defensive mechanism that operates on the same timescale as the campaign.
Graded medium: the targeting is consistently reported, and per-retailer technical detail beyond the M&S account has not been published.
Compiled from public reporting, listed below. Incident detail specific to Harrods has not been disclosed publicly and we are not inferring it from the other cases. Corrections: corrections@forensicpost.com.