You have to buy underwear or prawn sandwiches in the UK to know M&S exists?

Why is that surprising?

I guess I’d expect them to be in a country where it’d be difficult to be apprehended and extradited. Being in the UK seems like a stupid move to me, but what do I know!

Was it a professional operation? Says they were 17. Some people playing around with their Commodore 64 except it's connected to the internet and a pretty big company.

Let's not pretend these kids were trying to hack the Gibson just for the lulz. Calling into help desk, requesting password resets with social engineering, getting into network, installing ransomware is all well beyond playing around. I know there are smart teens, but I would not be surprised to find out there is someone more experienced in the background that got the kids going if not even on behalf of.

There are plenty of teens selling dope, stealing cars, breaking into homes, yet nobody thinks they're just knuckleheads playing around. Why do we think because "but on a computer" makes it different?

Likely an OCG behind them. I wouldn't be surprised to see a defence of exploitation.

Kids used to do stuff like wardialing, which is kind of on a similar level, with less actual humans involved though.

Cybercrime is usually international, cross-border, because (1) it's all online anyways, and so it's approximately equally difficult from any country, and (2) to disincentivize your own local law enforcement from getting involved.