M&S ransomware shows why privileged identity controls still fail

At a glance

What this is: This is an analysis of the M&S ransomware incident and the identity and access weaknesses that let a privileged credential reset cascade into wider compromise.

Why it matters: It matters because retail, third-party service accounts, and on-prem Active Directory still create attack paths that IAM, PAM, and lifecycle controls must close.

👉 Read IS Decisions' analysis of the M&S ransomware attack and AD defence

Context

The core issue here is not ransomware alone, but privileged identity exposure in a hybrid retail environment. When a reset credential at a third-party provider can become the entry point to Active Directory, existing trust boundaries are too permissive and too brittle for real-world operations.

Retail identity estates often mix on-premises AD, legacy applications, shared trust with suppliers, and privileged support processes. That combination means credential handling, authentication strength, and session oversight have to be treated as one control plane, not separate problems.

Key questions

Q: What breaks when privileged account resets can be socially engineered?

A: When privileged resets are weakly verified, the reset process becomes an attack path rather than a recovery control. Attackers do not need to steal a password if they can persuade or trick a support process into issuing a new trust token. That creates immediate risk for AD, privileged applications, and any downstream identity path that accepts the reset as legitimate.

Q: Why do third-party support identities increase ransomware risk?

A: Third-party support identities often have broad reach, but limited visibility and weaker governance than internal privileged accounts. If those paths are not tightly scoped, the attacker inherits the supplier’s trust relationship and can pivot into core systems. The risk grows when reset authority, remote access, and administrative permissions are bundled together.

Q: How can security teams tell whether AD is too exposed?

A: Look for excessive group membership, privileged accounts that are rarely reviewed, and reset or support paths that can reach domain assets without separate approval. If an account can cross from helpdesk or supplier access into directory administration, the blast radius is too large. Continuous session monitoring should also show whether identity use matches expected machine, location, and time patterns.

Q: Who is accountable when a service provider reset leads to ransomware impact?

A: Accountability sits with the organisation that allowed the privileged path to exist, the supplier that operated it, and the governance process that failed to constrain it. In practice, this is where IAM, PAM, and third-party risk management must intersect. If any one of those functions owns the problem alone, the control model is incomplete.

Technical breakdown

How privileged credential resets become an entry point

A reset credential is only as safe as the process that issues, stores, and validates it. In environments with third-party support and shared administration, a privileged reset can bypass ordinary user controls if the reset workflow is weakly authenticated or socially engineered. Once the credential is accepted, the attacker is no longer trying to break in from the outside. They are operating inside a trusted identity path that may already have elevated reach into directory services, management consoles, or administrative tooling.

Practical implication: reset workflows for privileged accounts need step-up verification, not just operational convenience.

Why Active Directory remains a high-value identity target

On-prem Active Directory still concentrates authentication, group membership, and domain trust in one place, which makes it a prime target after credential compromise. The domain controller database, including ntds.dit, can expose hashes and account relationships that enable broader movement if defenders do not detect abnormal access quickly. The challenge is structural: once attackers reach AD-level trust, they can often escalate from a single identity event into domain-wide impact.

Practical implication: protect AD as a crown-jewel identity system with layered monitoring and privileged access constraints.

How MFA and monitoring reduce lateral movement after compromise

MFA changes the economics of compromised credentials by making a stolen password less useful, but it does not replace session visibility or privilege containment. Real-time account monitoring adds the missing detection layer, especially where unusual IP use, out-of-hours access, or unexpected machine context indicates misuse. In high-trust environments, the combination matters because compromise is often discovered after the first access event, not before it.

Practical implication: pair MFA with session-level alerts and automated blocking on abnormal access patterns.

Threat narrative

Attacker objective: The attacker objective was to convert a single privileged identity weakness into enterprise-wide ransomware impact and operational disruption.

1. Entry occurred when attackers leveraged a reset privileged employee credential at an external service provider, giving them a trusted access path into the environment.
2. Escalation followed as the attackers targeted Active Directory and the ntds.dit domain controller file, increasing the value of the compromised identity path.
3. Impact came through widespread ransomware disruption that affected the retailer and its supply chain for months and drove major response and revenue loss.

Breaches seen in the wild

• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.
• Reviewdog GitHub Action supply chain attack — reviewdog/action-setup GitHub Action supply chain attack exposed secrets.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Privileged credential resets are a governance failure, not an operational footnote. The M&S case shows that when reset processes can be socially engineered, the organisation has effectively moved a privileged trust decision outside its control boundary. That is an IAM and PAM problem before it becomes a ransomware problem. Practitioners should treat privileged resets as high-risk identity events that require explicit governance.

Standing trust in third-party support paths creates identity blast radius. Retail environments depend on service providers, but the incident shows that vendor access can outlive the assumptions that justified it. Third-party identity paths need the same lifecycle scrutiny as internal accounts, because accountability collapses when reset authority and administrative reach are not tightly bounded. The implication is that supplier access must be governed as privileged access, not as convenience access.

Active Directory remains a systemic identity concentration point. When AD stores authentication, group membership, and password hashes, a compromise there is not a local event. It is a domain-wide control failure that exposes the limits of legacy trust models built before zero trust and continuous verification became standard. Practitioners should treat AD hardening as a core resilience requirement, not a background hygiene task.

Compromise detection has to move closer to session behaviour. The article’s emphasis on real-time monitoring points to a broader problem: many environments still discover identity abuse after the adversary has already moved laterally. Unusual IP use, out-of-hours access, and administrative prompt abuse are the signals that matter in these attacks. Security teams should design controls that can interrupt misuse while the session is still active.

Identity blast radius is now a board-level risk metric. A single privileged credential event can translate into months of disruption, supply chain effects, and major financial loss. That means IAM, PAM, and resilience teams need shared visibility into who can reset what, who can approve it, and how far that access reaches. Practitioners should measure blast radius, not just control count.

From our research:

• The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
• Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the same study.
• For teams building a response path, 52 NHI Breaches Analysis shows how identity failures repeatedly turn into broad operational incidents.

What this signals

Identity blast radius: this incident is a reminder that identity risk is measured by how far one reset can travel, not by how many controls are written down. For retail and other supplier-heavy environments, the governance question is whether a compromised support identity can touch directory trust, privileged administration, and business continuity in the same chain.

The practical signal for IAM and PAM leaders is that legacy AD estates remain vulnerable wherever support access is not continuously verified. If unusual access, reset authority, and administrator privileges are not reviewed together, the programme is still optimised for static trust rather than active misuse. That is where modern identity resilience starts to fail.

With 27 days as the average time to remediate a leaked secret, delayed response can no longer be treated as an edge case. Teams should assume that credential exposure and privileged misuse may persist long enough to become business disruption unless detection and containment are embedded into the access path.

For practitioners

• Harden privileged reset workflows Require strong step-up verification, dual approval where risk is high, and audited context checks before any privileged account reset is accepted.
• Constrain third-party administrative paths Map every external support and service-provider identity that can influence AD or privileged systems, then remove standing access that is not time-bound and explicitly approved.
• Add session-aware monitoring for AD Alert on unusual IP addresses, out-of-hours activity, unexpected machine context, and administrative prompt abuse so identity misuse can be blocked before lateral movement completes.
• Reduce AD privilege concentration Separate administrative duties, limit group scope, and review whether any account can reach directory assets that are not required for its business function.

Key takeaways

• The M&S incident shows that a single privileged credential reset can become an enterprise ransomware event when identity governance is too loose.
• The scale of harm matters: months of disruption and hundreds of millions of dollars in losses show why identity controls are a resilience issue, not just a security issue.
• Step-up verification, third-party access scoping, and real-time AD monitoring are the controls most likely to limit this attack path.

Key terms

• Privileged Credential Reset: A privileged credential reset is the issuance of a new secret or authentication factor for an account with elevated access. In practice, the risk is not the reset itself but the control environment around it, especially when verification, approval, and audit trails are weak.
• Identity Blast Radius: Identity blast radius is the amount of damage an attacker can do after compromising a single account or credential. It reflects privilege scope, trust chaining, and how far one identity can reach across directory services, applications, suppliers, and administrative controls.
• Active Directory Trust Path: An Active Directory trust path is any route by which an identity can obtain or expand authority inside AD. It includes delegated administration, group membership, service support roles, and reset workflows that attackers can abuse if they are too broadly trusted.
• Session-Aware Monitoring: Session-aware monitoring tracks how an identity behaves during active use rather than only checking whether authentication succeeded. It helps defenders detect unusual machine, location, time, or administrative patterns that can signal misuse after initial access has already occurred.

What's in the full article

IS Decisions' full article covers the operational detail this post intentionally leaves for the source:

• Step-by-step guidance on strengthening on-prem Active Directory defence with MFA and contextual access controls.
• Practical examples of real-time session monitoring, alert tuning, and account blocking for suspicious activity.
• Implementation detail for reducing lateral movement through user account control and SSO integration.
• Operational considerations for keeping identity workflows on-premises in hybrid AD environments.

👉 The full IS Decisions article covers the AD attack path, monitoring controls, and the specific identity lessons from M&S.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.