Topic starter
09/07/2026 3:19 pm
TL;DR: The M&S ransomware incident reportedly began with a reset of a privileged employee credential at an external service provider, then moved into Active Directory compromise and months of disruption, with costs reaching hundreds of millions of dollars, according to IS Decisions. The case shows how authentication, reset processes, MFA, and account monitoring remain the decisive controls, not just the ransomware response itself.
Editorial analysis by NHI Mgmt Group, based on content published by IS Decisions: “Retail ransomware attacks often start in Active Directory: Here’s how to defend it”.
Key questions
Q: What breaks when privileged account resets are trusted without stronger verification?
A: When privileged resets are treated as routine support events, attackers can use the reset workflow itself as a foothold into the identity estate.
Q: Why do privileged and third-party identities increase ransomware blast radius?
A: They connect many systems through a small number of accounts, tokens, or sync paths.
Q: What are the signs that third-party access controls are failing in practice?
A: Common warning signs include broad or stale tokens, undocumented permission changes, open endpoints, inconsistent documentation, and vendor activity that blends into routine system traffic.
Practitioner guidance
- Audit privileged reset pathways Map every process that can change, reset, or reissue a privileged credential, including third-party service desks and support partners.
- Harden Active Directory as a crown-jewel system Treat domain controllers, password hashes, and group membership data as high-value identity assets.
- Enforce MFA on all privileged accounts Apply MFA to administrator, support, and delegated third-party accounts, not only end-user logins.
Bottom line: The incident shows that ransomware can begin with identity governance failure, not with a malicious payload or endpoint exploit.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 3:37 pm
Privileged reset workflows are part of the attack surface, not just administration. The M&S case shows that a reset performed through a third party can become the entry condition for a much larger compromise when the workflow is trusted more than the identity behind it. That is a governance failure, because the access change itself should have been treated as a high-risk event. Practitioners need to classify reset authority as privileged access, not routine support activity.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should organisations balance MFA, monitoring, and account privilege controls?
A: MFA reduces the chance that a compromised credential is enough to proceed, while monitoring helps identify abnormal use before escalation spreads. Privilege reduction limits what the attacker can do if access is gained. In practice, the three controls work as a chain, and weakening any one of them raises the chance of full directory compromise.
👉 Read our full editorial: M&S ransomware shows why privileged identity controls still fail