Four people have been arrested by police investigating the cyber-attacks that have caused havoc at M&S and the Co-op.

The National Crime Agency (NCA) says a 20-year-old woman was arrested in Staffordshire, and three males – aged between 17 and 19 – were detained in London and the West Midlands.

They were apprehended on suspicion of Computer Misuse Act offences, blackmail, money laundering and participating in the activities of an organised crime group.

All four were arrested at their homes in the early hours of Thursday. Electronic devices were also seized by the police.

One of the suspects – a 19-year-old man – is from Latvia, the rest are from the UK.

Neighbours described a large police operation in the quiet Staffordshire cul-de-sac where the 20-year-old was arrested.

They said dozens of NCA officers, some wearing balaclavas, arrived in the early hours of this morning and smashed down the door of a family home. Later they were seen taking away a large number of electronic devices.

Paul Foster, head of the NCA’s National Cyber Crime Unit, said the arrests were a “significant step” in its investigation.

“But our work continues, alongside partners in the UK and overseas, to ensure those responsible are identified and brought to justice,” he added.

The hacks – which began in mid April – have caused huge disruption for the two retailers.

Some Co-op shelves were left bare for weeks, while M&S expects its operations to be affected until late July, with some IT systems not fully operational until October or November.

The chairman of M&S told MPs this week that it felt like the hack was an attempt to destroy the business. The retailer has estimated it will cost it £300m in lost profits.

Harrods was also targeted in an attack that had less impact on its operations.

M&S was the first to be breached. A huge amount of private data belonging to customers and staff was stolen.

The criminals also deployed malicious software called ransomware scrambling the company’s IT networks making them unusable unless a ransom was paid.

The BBC revealed that the hackers had sent an offensive email to the M&S boss demanding payment.

A few days after M&S was breached the Co-op was also targeted by criminals who broke in and stole the private data of millions of its customers and staff.

The Co-op was forced to admit that the data breach had happened after hackers contacted the BBC with proof that the firm was downplaying the cyber attack.

The BBC later discovered from the criminals that the company disconnected the internet from IT networks in the nick of time to stop the hackers from deploying ransomware and so causing even more disruption.

Shortly after Co-op announced it had been attacked, luxury retailer Harrods said it too had been targeted and had been forced to disconnect IT systems from the internet to keep the criminals out.

The four people arrested are a 17-year-old British male from the West Midlands, a 19-year-old British man from London, a 19-year-old Latvian male from the West Midlands and a 20-year-old British woman from Staffordshire.

The NCA said its operation was supported by officers from the West Midlands Regional Organised Crime Unit and the East Midlands Special Operations Unit.