Your help desk is now your security perimeter

In spring 2025, attackers took Marks and Spencer’s online store offline for several weeks. They did not need to exploit a software vulnerability to get in. They phoned the IT help desk and persuaded staff to reset account credentials. The lesson applies well beyond retail: the process for recovering an account has become one of the easiest ways to take it over.

What happened

The attack on Marks and Spencer began in spring 2025. It disrupted the company’s online sales for several weeks, and M&S estimated the cost at around £300 million. The attack was attributed to the group known as Scattered Spider.

The attackers did not break in through a software flaw. Instead, they called the IT service desk, which was run by an outsourced provider, posed as members of staff, and persuaded the desk to reset their credentials.

Co-op and Harrods were targeted in the same period. The approach was the same each time: it is quicker and quieter to persuade the people who reset passwords and security devices than to break the systems those credentials protect.

Multi-factor authentication protects the sign-in. It does not protect the phone call in which someone asks for that second factor to be replaced.

Why account recovery is the weak point

Over the past decade, most organisations have made signing in much harder to attack. Account recovery has not had the same attention. Service desks are measured on how quickly they get people working again, and a caller who sounds senior, stressed and short of time is exactly the kind of person they are trained to help.

The risk is greater when the service desk is outsourced. The person approving a reset may never have met the employee they are verifying, and the verification rules are written into a contract rather than enforced by a system.

The call

The attacker phones the service desk, posing as an employee who has lost their phone or been locked out. They often use real names and job titles found online to sound convincing.

The reset

The desk resets the password and registers a new security device, which belongs to the attacker. The account now belongs to them, even though it was protected by strong authentication.

The spread

Most organisations use single sign-on, so one compromised account opens every connected application. From there, the attacker looks for administrator access.

What to change this quarter

1. Never verify on the incoming call

   Call the employee back on a number already on record, or confirm the request with their manager through a separate channel. If the caller cannot be reached that way, the reset should not go ahead.

2. Treat security device resets as high risk

   Registering a new multi-factor device should require stronger checks than a password reset. For administrator accounts, it should also need approval from a second person.

3. Make every reset visible

   Alert the employee on all their existing contact channels whenever their password or device is reset. Alert the security team if a reset is quickly followed by access to sensitive systems.

4. Give administrators phishing-resistant sign-in

   Hardware security keys and passkeys cannot be handed over during a phone call. Start with the accounts that would cause the most damage if they were compromised.

5. Write the controls into supplier contracts, and test them

   If your service desk is outsourced, set out the verification procedure in the contract, audit it regularly, and commission a controlled social engineering test against it.

Sources

• Marks and Spencer statements on the cost and duration of the 2025 cyber incident, reported in May 2025
• Infosecurity Magazine: Inside the Scattered Spider playbook, how UK retailers were socially engineered
• Computing and The Register: reporting on M&S ending its service desk contract, October 2025