M&S ransomware shows why privileged identity controls still fail

At a glance

What this is: This is an analysis of the M&S ransomware incident and how a reset privileged credential at an external provider appears to have opened the path into Active Directory.

Why it matters: It matters because many IAM and PAM programmes still assume reset workflows, third-party access, and on-prem directory protections are separate problems, when this case shows they are one governance chain.

Context

M&S ransomware is a privileged access governance problem as much as it is a malware story. The source article says the attack began with a reset of a privileged employee credential at an external service provider, then progressed into Active Directory and long-running business disruption.

Retail environments are especially exposed because identity paths run through third parties, legacy directory infrastructure, and operational reset processes that are often trusted more than they are verified. When a credential reset is enough to change the access boundary, the identity programme has already accepted too much risk into the workflow.

Key questions

Q: What breaks when privileged account resets are trusted without stronger verification?

A: When privileged resets are treated as routine support events, attackers can use the reset workflow itself as a foothold into the identity estate. The result is not just one compromised account but a path into directory services, where privilege can be expanded and lateral movement becomes far easier. That is why reset authority must be governed as high-risk access.

Q: Why do privileged and third-party identities increase ransomware blast radius?

A: They connect many systems through a small number of accounts, tokens, or sync paths. If one of those identities is compromised, the attacker can pivot into backup, admin, or directory functions that ordinary users never touch. That makes these identities high leverage and high risk, especially when their lifecycle is not tightly governed.

Q: What are the signs that third-party access controls are failing in practice?

A: Common warning signs include broad or stale tokens, undocumented permission changes, open endpoints, inconsistent documentation, and vendor activity that blends into routine system traffic. Another signal is when teams cannot clearly explain who owns an integration or what happens if access must be revoked quickly. Those are usually indicators that governance has drifted.

Q: How should organisations balance MFA, monitoring, and account privilege controls?

A: MFA reduces the chance that a compromised credential is enough to proceed, while monitoring helps identify abnormal use before escalation spreads. Privilege reduction limits what the attacker can do if access is gained. In practice, the three controls work as a chain, and weakening any one of them raises the chance of full directory compromise.

Technical breakdown

Why privileged credential resets become attack entry points

A reset is not a neutral administrative event when the identity being changed already has elevated access. In this case, the article describes an external service provider reset that preceded the compromise, which suggests the attackers benefited from process trust rather than breaking encryption or exploiting a software flaw. The technical issue is that reset authority can function as a hidden authentication path if it is not bound to strong verification, MFA, and tight provenance checks. In practice, the attacker does not need to steal the original password if the workflow itself can be influenced or abused.

Practical implication: treat privileged resets as high-risk access changes and require stronger verification than ordinary account administration.

How Active Directory becomes the high-value target

Active Directory remains the control plane for many on-prem and hybrid environments because it stores user accounts, group membership, and password hashes. The article says the attackers targeted the domain controller database, ntds.dit, which is valuable because compromise there can expose credential material and enable broader privilege escalation. This is why weak account hygiene in one part of the environment can become enterprise-wide identity risk in another. The core problem is not just access to one account, but access to the directory structures that define who can do what across the estate.

Practical implication: harden directory services as a crown-jewel system, not as a background infrastructure component.

Why monitoring and MFA still decide containment

MFA and account monitoring remain decisive because privileged compromise often becomes visible only after suspicious authentication patterns or lateral movement attempts begin. The article highlights lack of strong authentication, weak monitoring, and over-privileged accounts as enabling conditions. That matters because in a directory-led environment, containment depends on detecting abnormal access early enough to stop privilege escalation before the attacker can harvest more credential material or move laterally. Controls that merely log access after the fact do not change the attack outcome.

Practical implication: pair MFA with live session monitoring and alerting on privileged accounts, especially where resets can trigger escalation.

Threat narrative

Attacker objective: The objective was to turn a privileged identity workflow into broad directory access that could support ransomware-driven disruption and business impact.

1. Entry appears to have started with a reset of a privileged employee credential at an external service provider, giving the attacker a trusted foothold into the identity workflow.
2. Credential use then shifted toward on-premises directory compromise, with the article naming Active Directory and the ntds.dit database as the target.
3. Escalation followed through access to account and password-hash material, which can enable wider privilege abuse across the environment.
4. Impact was prolonged disruption across the business and supply chain, with incident and revenue costs reported in the hundreds of millions of dollars.

Breaches seen in the wild

• Storm-0501 hybrid cloud attacks 2024: Ransomware affiliate Storm-0501 stole Entra Connect Sync credentials to move from on-prem AD to Entra ID, then forged tokens via a rogue federated domain.
• Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Privileged reset workflows are part of the attack surface, not just administration. The M&S case shows that a reset performed through a third party can become the entry condition for a much larger compromise when the workflow is trusted more than the identity behind it. That is a governance failure, because the access change itself should have been treated as a high-risk event. Practitioners need to classify reset authority as privileged access, not routine support activity.

Active Directory is still the identity crown jewel in hybrid retail environments. The article's emphasis on ntds.dit is a reminder that directory compromise remains a force multiplier for attackers. Once account stores, group memberships, or hashes are exposed, the breach stops being about one account and becomes about the identity structure of the enterprise. Directory hardening, segmentation, and privileged monitoring are inseparable from ransomware resilience.

Standing trust in third-party service providers creates identity blast radius. The article points to external provider involvement and long supply chains built on shared trust. That means third-party access is not just a vendor-risk topic, it is an identity governance topic with direct escalation consequences. Organisations should expect supplier accounts, delegated resets, and support pathways to be targeted as the easiest route around stronger perimeter controls.

Authentication failure is the root control, not the ransomware payload. The story is not that ransomware suddenly became more dangerous on its own; it is that identity controls failed early enough to let the attack reach the directory layer. MFA, monitoring, and privilege limits are the controls that change the attacker’s economics. Without them, the response phase begins after the critical decisions have already been lost.

Reset authority without lifecycle offboarding creates long-tail exposure. The article suggests that the dangerous part of the chain was not a single login, but the ability of a credential reset to outlive the context in which it should have been valid. That exposes a lifecycle gap: privileges and reset pathways can persist beyond the business need that justified them. The practical conclusion is to govern privileged identity lifecycles with the same rigour as production access.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: Active Directory and Entra ID Hardening Guide

What this signals

Third-party identity trust is the real control boundary: M&S shows that a privileged reset outside the core environment can become the first link in a broader compromise chain. Retailers should assume supplier access, support workflows, and delegated resets are part of the attack surface, not peripheral operations.

Identity blast radius grows when on-prem directory services and third-party support pathways are governed separately. The practical shift is to review whether privileged account changes, reset authority, and MFA enforcement are managed as one lifecycle rather than three disconnected controls.

For practitioners

• Audit privileged reset pathways Map every process that can change, reset, or reissue a privileged credential, including third-party service desks and support partners. Require named approval, verification evidence, and a clear accountability trail for each pathway.
• Harden Active Directory as a crown-jewel system Treat domain controllers, password hashes, and group membership data as high-value identity assets. Segment administrative access, reduce standing privilege, and monitor for unusual access to directory databases such as ntds.dit.
• Enforce MFA on all privileged accounts Apply MFA to administrator, support, and delegated third-party accounts, not only end-user logins. Make sure authentication is required for reset actions and for any path that can elevate access.
• Monitor for abnormal privileged activity in real time Alert on unusual IPs, machines, geographies, and access timing for privileged identities. Connect those alerts to account disablement or session termination so suspicious access can be contained quickly.
• Review third-party identity dependencies Inventory supplier accounts, delegated access, and external reset authorities, then remove access that is no longer operationally required. Offboarding and recertification should cover the full support chain, not only employees.

Key takeaways

• The incident shows that ransomware can begin with identity governance failure, not with a malicious payload or endpoint exploit.
• Months of disruption and costs in the hundreds of millions illustrate how privileged access compromise expands from a single account into enterprise and supply chain impact.
• Stronger MFA, tighter reset governance, and real-time privileged monitoring are the controls most likely to stop the attack before directory compromise.

Key terms

• Privileged Credential Reset: A privileged credential reset is the issuance of a new secret or authentication factor for an account with elevated access. In practice, the risk is not the reset itself but the control environment around it, especially when verification, approval, and audit trails are weak.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Third-Party Access: Third-party access is access granted to vendors, contractors, or support partners who are not direct employees of the organisation. It is higher risk than internal access because accountability, device assurance, and access duration are harder to control, so it usually requires tighter time limits and stronger auditability.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.