Topic starter
16/10/2026 9:31 am
TL;DR: Scattered Spider used a help-desk impersonation and stolen account to reach 148 Transport for London systems, leading to £29 million in losses and sixteen hours of escalation, according to Oak. The real control failure is not authentication alone but unchecked identity reach, because standing privilege turns one reset into enterprise-wide impact.
Editorial analysis by NHI Mgmt Group, based on content published by Oak: “One Phone Call. 148 Systems. £29 Million.”.
By the numbers:
- Two members of Scattered Spider were sentenced in July 2026 for the 2024 Transport for London attack.
- The attack reached 148 systems and caused roughly £29 million in losses.
Key questions
Q: What breaks when a help desk can reset access for a compromised user account?
A: When support can reset passwords or re-enrol MFA for an impersonated user, the recovery path becomes the real attack path.
Q: Why does standing privilege still create so much identity risk?
A: Standing privilege keeps elevated access available long after the work that justified it has ended.
Q: How do security teams know whether identity governance is reducing risk?
A: Look for shorter time from access change to visibility, fewer unmanaged entitlements, and faster completion of review and remediation cycles.
Practitioner guidance
- Map identity blast radius Resolve each high-value account’s effective permissions through nested groups, inherited admin, and resource-level entitlements so you know what one reset can touch.
- Govern help-desk recovery as privileged access Treat password resets, MFA re-enrollment, and exception handling as controlled privileged workflows with explicit approvals and audit evidence.
- Convert excess access into just-in-time grant paths Split genuinely needed access into birthright permissions and ephemeral access windows so standing privilege does not persist by default.
Bottom line: The Transport for London attack shows that social engineering becomes much more damaging when one account has broad inherited reach.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
16/10/2026 9:32 am
Identity reach, not authentication strength, is the decisive variable in help-desk attacks. The Transport for London case shows that a compromise path can begin with perfectly ordinary recovery steps and still produce major impact. Strong authentication on a compromised enrollment or reset path simply authenticates the attacker more reliably. Practitioners should therefore measure how much an identity can reach after recovery, not just whether login controls worked.
A question worth separating out:
Q: Should organisations prioritise just-in-time access over more verification at the help desk?
A: They should do both, but just-in-time access changes the consequence of a successful social-engineering call. Better verification reduces the chance of compromise, while short-lived access reduces what the attacker can do after compromise. When reach is large, reducing standing privilege usually has the bigger effect on business impact.
👉 Read our full editorial: Phone reset abuse shows why identity reach drives breach impact