Topic starter
24/06/2026 9:11 pm
TL;DR: Scattered Spider exploited weak service desk processes and privileged access paths at a third-party IT provider to pivot into Marks & Spencer and other retailers, with the M&S campaign leading to months of undetected access, ransomware deployment, and more than $400 million in lost profit, according to 1Kosmos. The breach shows that inherited vendor trust, not perimeter controls, is the failure point in modern retail identity governance.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “What the Marks & Spencer Breach Tells Us About the Next Era of Identity Attacks”.
By the numbers:
- More than $400 million in lost profit followed the Marks & Spencer campaign.
- More than 60% of consumers would stop shopping with a brand that suffered a security incident, according to the article.
Key questions
Q: What breaks when a service desk can reset privileged access for vendors?
A: The access chain breaks when help desk staff can validate identity too weakly and extend privilege on behalf of another party.
Q: Why do third-party service desks increase lateral movement risk?
A: They increase risk because one provider can hold rights across multiple client environments, so a single compromise can be reused for repeated privileged actions.
Q: What are the warning signs that vendor trust is too broad?
A: Watch for reset, approval, or re-enrolment workflows that can be completed by a small support group without strong reauthentication or separate approval.
Practitioner guidance
- Harden help desk recovery workflows Require strong identity proofing before any password reset, factor re-enrolment, or privileged access recovery action, especially where the requester is a vendor or contractor.
- Revoke standing vendor privilege Replace inherited third-party access with task-scoped, reauthenticated sessions that expire after each approved action and cannot be reused across client environments.
- Separate provider access domains Ensure a compromise in one supplier account cannot open the same privileged path across multiple retail tenants, directories, or management planes.
Bottom line: The breach exposed a supply chain identity failure, not a simple perimeter intrusion, because the attackers used a third-party service desk to reach retail systems.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 6:14 am
Vendor trust is now an attack surface, not a procurement detail: The article shows that a compromise of the service desk provider became a direct route into the retailer's environment. That means the security boundary is no longer the retailer alone, but the identity authority shared with suppliers. Retail IAM teams should treat third-party operational trust as a governed control plane, not a contractual assumption.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- 61% of organisations still define privileged users as humans only, overlooking the role of non-human identities in privileged access, according to KPMG.
A question worth separating out:
Q: How should retailers respond when a provider's privileged access is abused?
A: Containment should start by disabling inherited paths from the provider, not by focusing only on endpoint cleanup. Then review every client environment the provider could reach, because the real exposure is often the full span of delegated privilege, not the first compromised account.
👉 Read our full editorial: Scattered Spider exposed vendor trust gaps in retail service desks
This post was modified 1 day ago by NHI Mgmt Group