The National Crime Agency announced the news on 10 July, explaining that two males aged 19, another aged 17, and a 20-year-old female had been arrested following an investigation into the attacks.
The four people were apprehended at their home addresses in the West Midlands and London on suspicion of Computer Misuse Act offences, blackmail, money laundering and participating in the activities of an organised crime group.
They have had their electronic devices seized for digital forensic analysis and remain in custody for questioning by officers from the National Crime Agency’s National Cyber Crime Unit in relation to the three attacks which took place earlier this year.
Head of the National Cyber Crime Unit, deputy director Paul Foster, said: “Since these attacks took place, specialist NCA cybercrime investigators have been working at pace and the investigation remains one of the Agency’s highest priorities.
“Today’s arrests are a significant step in that investigation but our work continues, alongside partners in the UK and overseas, to ensure those responsible are identified and brought to justice.
“Cyberattacks can be hugely disruptive for businesses and I’d like to thank M&S, Co-op and Harrods for their support to our investigations. Hopefully this signals to future victims the importance of seeking support and engaging with law enforcement as part of the reporting process. The NCA and policing are here to help.”
Co-op announced last month that it was nearing a full recovery from the cyberattack, which had a “small impact” on some of its back office and call centre services.
Meanwhile, a class action lawsuit has been launched against Marks & Spencer on the behalf of people that had their data stolen in the attack.
The suit was launched by law firm Thompsons Solicitors Scotland in May with the goal of securing compensation for people impacted.
