14th July 2025 Cyber Update: UK Retail Hack Arrests, CitrixBleed 2 Exploited, McDonald’s AI Hiring Breach Exposes 64M

Update: The NCA arrested four individuals on Thursday in connection with devastating cyberattacks that hit major UK retailers M&S, Co-op, and Harrods in April and May 2025. The suspects include a 20-year-old woman detained in Staffordshire and three males aged 17-19 arrested in London and the West Midlands, with one being a Latvian national.

Authorities seized electronic devices and are holding the suspects on charges under the Computer Misuse Act, plus blackmail, money laundering, and organized crime group involvement. The attacks, suspected to be linked to the notorious Scattered Spider cybercrime collective, caused extensive disruption with M&S alone facing £300 million in lost profits and some systems remaining offline until October.

Why it Matters: These arrests represent a significant breakthrough in combating sophisticated cybercrime groups that target critical retail infrastructure. The connection to Scattered Spider, known for advanced social engineering tactics and attacks on major organizations like MGM Resorts and Caesars Entertainment, highlights the international scope of modern cyber threats.

The massive financial impact on M&S demonstrates how cyberattacks can threaten business continuity and economic stability. The involvement of teenagers in such sophisticated operations underscores the evolving threat landscape where young individuals can cause hundreds of millions in damages, emphasizing the need for enhanced cybersecurity education and international cooperation in law enforcement.

Update: CISA has confirmed active exploitation of CVE-2025-5777, dubbed "CitrixBleed 2," affecting Citrix NetScaler ADC and Gateway systems. The agency added this critical vulnerability to its Known Exploited Vulnerabilities (KEV) catalog and issued a binding operational directive requiring federal agencies to patch within 24 hours.

The flaw, with a CVSS v4.0 score indicating high severity, allows attackers to bypass multi-factor authentication and hijack user sessions without requiring authentication. Proof-of-concept exploits became publicly available shortly after technical details were disclosed, leading to rapid weaponization by threat actors. The vulnerability affects widely deployed enterprise networking infrastructure used by organizations globally.

Why it Matters: The rapid exploitation of CitrixBleed 2 demonstrates how quickly attackers can weaponize newly disclosed vulnerabilities, particularly those affecting critical network infrastructure. The ability to bypass MFA and hijack sessions makes this vulnerability extremely dangerous for enterprise environments where Citrix systems often serve as gateways to sensitive internal networks.

CISA's emergency directive reflects the severity of the threat to federal systems and critical infrastructure. Organizations using Citrix NetScaler systems face immediate risks of unauthorized access, data theft, and lateral movement within their networks. The 24-hour patching deadline underscores the urgency of addressing this actively exploited vulnerability.

Update: Cybersecurity researchers discovered that McDonald's McHire AI hiring platform exposed personal data from over 64 million job applications across the United States due to a critical security flaw. The breach occurred because the system used a default administrator username and password combination of "123456," allowing researchers to access live applicant dashboards and extract personally identifiable information through a vulnerable API. The exposure affected job seekers' names, contact information, and application details stored in the AI-powered recruitment system. McDonald's has since secured the platform, but the incident highlights fundamental security failures in AI-driven hiring tools that process sensitive personal data at scale.

Why it Matters: This breach demonstrates how AI systems can amplify security risks when basic protections are overlooked during deployment. The use of default credentials in a system processing millions of applications reveals dangerous gaps in AI security governance, particularly for platforms handling sensitive personal information. The incident affects job seekers who trusted McDonald's with their personal data, potentially exposing them to identity theft and fraud. This case illustrates the broader challenge of securing AI-powered business tools, where rapid deployment often outpaces security considerations, creating massive exposure risks for both companies and individuals.