What DDoS Attacks on M&S and Harrods Reveal About Our Digital Fragility
On the surface, distributed denial-of-service (DDoS) attacks may seem like just another cybersecurity nuisance. But when some of the UK’s most recognisable retail giants—Marks & Spencer, Harrods, and Co-op—suffer coordinated disruptions, the headlines become a sobering reminder of the digital fragility beneath our most trusted brands. These attacks aren’t just technical blips; they are orchestrated invasions carried out by vast networks of compromised devices, aptly described as digital “zombies.”
This post explores what recent events tell us about the state of cyber preparedness, why DDoS attacks persist, and how principles like mirror site architecture and encrypted fallbacks could represent an underused yet powerful form of defence.
The Nature of the Modern Zombie Horde
Imagine thousands, even millions, of infected devices—from home routers to CCTV cameras—silently conscripted into a botnet. Without warning, they march in unison against a single target, flooding it with meaningless requests. This is the hallmark of a DDoS attack. But unlike horror films where the undead eventually rot away, these digital zombies regenerate with ease, making them not just terrifying but relentless.
In the recent cases of M&S and Harrods, systems were knocked offline, payment systems slowed to a crawl, and customer-facing services became inaccessible. It was chaos not caused by a breach of internal data, but by an external flood that proved too much to handle. The cost to brand reputation and trust was immediate—and measurable.
What Makes DDoS So Effective?
There are three reasons why DDoS attacks continue to plague even the largest institutions:
- Volume: Modern attacks can exceed hundreds of gigabits per second, instantly overwhelming bandwidth.
- Anonymity: The source is rarely traceable, thanks to the use of hijacked devices across the globe.
- Disruption without Penetration: No need to crack firewalls or steal data; all the attacker needs to do is deny service long enough to cause reputational damage or financial loss.
Add to this the increasing availability of DDoS-for-hire services, and suddenly, cyberattacks have a disturbingly low barrier to entry. Even inexperienced attackers can purchase short-term assaults, weaponising disruption for as little as the cost of a cup of coffee.
Personal Experience: From Protx to SSLPost
Speaking from direct experience, I, Michael Clarke, was a shareholder in Protx during its formative years. At the time, we were one of the earliest targets of coordinated DDoS activity. The lessons learned were foundational in developing defensive systems that later formed the backbone of SSLPost, now also distributed by Data Transfer Security (DTS).
Since implementing site resilience and encrypted communication protocols, we have never suffered a successful DDoS attack. The key wasn’t just in blocking traffic, but in intelligently rerouting it. We moved from defence to resilience—a shift more companies need to consider.
Additionally, by utilising our My Works App (MWA), we provide a reliable fallback system. If all else fails, critical communication can still take place, maintaining operational continuity and compliance with regulatory communication standards.
The Digital Equivalent of Emergency Exits
One promising, but underutilised strategy to counter such attacks lies in site resilience, encrypted communication protocols, and MWA. This involves reconfiguration of the primary website to distribute load and ensure continuity. When an attack targets one site, traffic can be seamlessly redirected to mirrors that remain unaffected.
According to research referenced by Access Now and various cybersecurity bodies:
- Redundancy ensures that if one site falls, others remain online.
- Load balancing spreads incoming traffic, preventing a single point of failure.
- Unpredictable routing makes it computationally expensive for attackers to target all mirrors simultaneously.
A particularly innovative approach extends this concept by fragmenting HTTP requests and randomly distributing them across multiple sites. This not only baffles attackers but makes sustained targeting virtually impossible. Sometimes referred to as ‘mirroring’, it allows organisations to implement contingency planning without sacrificing speed or service quality.
The Real Question: Are We Building Resilience or Just Reacting?
The recent wave of attacks on M&S, Harrods, and Co-op is not unique, and it’s unlikely to be the last. But each incident should act as a wake-up call, particularly for organisations who still rely on a single digital access point.
Are we designing our systems to resist attacks? Or are we just bracing for the next wave, hoping it won’t be ours?
Such site reconfigurations offer one of the simplest ways to introduce redundancy and resilience into otherwise monolithic architectures. They’re not a silver bullet, but they buy time—and in cyber defence, time is everything.
Conclusion: When the Zombies Come
The zombie metaphor is apt. DDoS attacks are relentless, faceless, and capable of overwhelming even the most fortified businesses. But they are not invincible.
With intelligent infrastructure design—such as decentralised access through reconfigured sites, unpredictability in routing, end-to-end encryption, MWA, and scalable bandwidth handling—it is possible to turn the tide.
As someone who’s seen these attacks evolve from the inside out, my advice is clear: Don’t wait for the horde. Fortify your exits, scatter your services, and always assume the next march is already underway.
If your organisation has faced downtime or is looking to future-proof its digital estate, now is the time to consider structural resilience. Because in the age of digital zombies, survival isn’t about running faster—it’s about being smarter.
