A phone call to the IT help desk has become one of the cheapest ways to get a valid identity inside a large organisation, and the cost of the resulting breaches is now on public record. This page collects the figures that are traceable to a primary source: government surveys, regulator and agency advisories, company filings, results statements and parliamentary evidence. Each figure carries its publisher and year so it can be cited and refreshed. It is for identity, security operations and service desk leaders who need numbers to justify stronger reset verification, and for anyone writing a business case. How to respond to a live incident is covered separately in the Help Desk Social Engineering Incident Playbook; this page is about the data.
Sources: DSIT, FBI IC3, Verizon, SEC filings, company results, UK Parliament evidence and agency advisories as cited on this page. Confirm against the official text before relying on it.
Last reviewed: November 2026.
Key takeaways
- Impersonation is common, not exotic. In the UK Cyber Security Breaches Survey 2025, 34% of businesses and 35% of charities that identified a breach or attack reported others impersonating the organisation or its staff.
- Impersonation-led breaches have cost nine figures. MGM Resorts estimated about $100 million of impact on Adjusted Property EBITDAR in its October 2023 filing, and Marks and Spencer estimated around £300m of impact on 2025/26 Group operating profit before mitigation.
- The reset is the breach. Co-op told Parliament that attackers impersonated a colleague by phone, answered security questions, and misused the reset account about an hour later.
- Outsourced desks are in scope. Caesars attributed its 2023 breach to a social engineering attack on an outsourced IT support vendor, and Clorox's 2025 lawsuit against its help desk provider seeks $380 million (an allegation, not a finding).
- Knowledge-based checks fail against prepared callers. The US HHS HC3 alert of April 2024 describes callers who already held the last four digits of the employee's SSN and a corporate ID number.
What the data covers and its limits
There is no annual dataset dedicated to help desk social engineering. The figures on this page come from three kinds of source, and each has a different weakness.
| Source type | Examples on this page | Strength | Limit |
|---|---|---|---|
| Government surveys | UK Cyber Security Breaches Survey 2025; FBI IC3 Internet Crime Report 2024 | Large samples, repeated every year, published method | Measure impersonation and fraud broadly, not help desk resets specifically |
| Agency advisories | CISA AA23-320A; HHS HC3 Sector Alert 202404031000; NCSC retail blog; Microsoft and Okta threat posts | Describe the exact technique and the targets | Qualitative; few counts |
| Company disclosures | MGM and Caesars Form 8-K filings; Marks and Spencer results; Co-op and M&S evidence to the UK Parliament; Clorox litigation | Real costs and timelines, with legal accountability for accuracy | Only large or listed organisations disclose; estimates are revised; lawsuit figures are claims |
Treat the incident costs as evidence of severity, not frequency. They show what one successful call can cost; they do not tell you how often calls succeed. For frequency, the best available proxies are the impersonation figures in national surveys and your own service desk data, discussed in the measurement section below.
Survey statistics on impersonation and social engineering
| Figure | Value | Source and as-of year |
|---|---|---|
| UK businesses that identified any cyber breach or attack in the last 12 months | 43% (about 612,000 businesses) | DSIT, Cyber Security Breaches Survey 2025 (fieldwork August to December 2024) |
| UK charities that identified any breach or attack | 30% (about 61,000 charities) | DSIT, Cyber Security Breaches Survey 2025 |
| Phishing, among organisations that identified a breach or attack | 85% of businesses, 86% of charities | DSIT, Cyber Security Breaches Survey 2025 |
| Others impersonating the organisation or staff in emails or online, among those that identified a breach or attack | 34% of businesses, 35% of charities | DSIT, Cyber Security Breaches Survey 2025 |
| Takeovers or attempted takeovers of website, social media or email accounts, among the same group | 7% of businesses, 9% of charities | DSIT, Cyber Security Breaches Survey 2025 |
| Businesses with an agreed process for staff to follow with fraudulent emails or websites | 55% of businesses, 39% of charities | DSIT, Cyber Security Breaches Survey 2025 |
| Business Email Compromise complaints and reported losses | 21,442 complaints; $2,770,151,146 | FBI IC3, Internet Crime Report 2024 |
| Tech support fraud complaints and losses | 36,002 complaints; $1,464,755,976 | FBI IC3, Internet Crime Report 2024 |
| Total complaints and losses reported to IC3 | 859,532 complaints; $16.6 billion | FBI IC3, Internet Crime Report 2024 |
| Breaches that start with software vulnerabilities, now ahead of stolen passwords as the top entry route | 31% | Verizon, Data Breach Investigations Report 2026 |
| Breaches involving ransomware | 48% | Verizon, Data Breach Investigations Report 2026 |
The survey sample for the 2025 UK survey was 2,180 businesses, 1,081 charities and 574 education institutions, and the impersonation and account takeover shares are of the 1,132 businesses and 445 charities that identified a breach or attack, not of all organisations. The IC3 categories are victim-reported fraud, so they capture the payment diversion that often follows a help desk compromise (as in the HHS case below) but not the reset itself. The Verizon headline is a reminder that help desk fraud competes with vulnerability exploitation for attackers' attention; it does not mean the help desk is lower risk for any given organisation.
Incident data: resulting breaches and their cost
These are the best-documented cases in which an identity reset or impersonation of a user to IT support is the disclosed or alleged entry point. Costs are as stated by the organisation, in its own currency and terms.
| Organisation and year | Entry point as disclosed | Disclosed impact | Primary source |
|---|---|---|---|
| MGM Resorts, September 2023 | The filing describes a "cybersecurity issue"; a help desk call is the attackers' own account, relayed in public reporting and not confirmed by MGM | About $100 million negative impact on Adjusted Property EBITDAR; less than $10 million in one-time expenses in Q3 2023; personal data of some pre-March 2019 customers, with Social Security and passport numbers for a limited number | MGM Resorts Form 8-K, October 2023 |
| Caesars Entertainment, September 2023 | "A social engineering attack on an outsourced IT support vendor" | Loyalty programme database taken, including driver's licence and/or Social Security numbers for a significant number of members; credit monitoring offered to all loyalty members | Caesars Form 8-K, 14 September 2023 |
| Clorox, August 2023 | Alleged: help desk agents handed over credentials and reset Okta and Microsoft MFA without verifying callers | $49 million remediation spend and $380 million damages sought, both as claimed in Clorox's July 2025 lawsuit; Cognizant disputes the claims | Lawsuit as reported by The Record, July 2025 |
| Marks and Spencer, April 2025 | Chairman's evidence: "sophisticated impersonation" on 17 April, with "part of the point of entry" involving a third party | Around £300m estimated impact on Group operating profit for 2025/26 before mitigation; online shopping paused | M&S full year results, May 2025; UK Parliament oral evidence, 8 July 2025 |
| Co-op, April 2025 | Attackers impersonated a colleague by phone and answered security questions to have the account reset | Member data copied (names, addresses, contact details, dates of birth); about 40 key pieces of equipment rebuilt; services restored around 14 days later; no ransom paid | UK Parliament oral evidence, 8 July 2025 |
The analyses on nhimg.org go deeper into each case: the MGM Resorts breach, the Caesars Entertainment breach, the Marks and Spencer cyberattack and the Co-op cyber attack.
Timing data from the incidents
- Reset to misuse: Co-op's Chief Digital Information Officer told the committee that the reset happened about an hour before the account was seen acting maliciously, and that defences flagged the activity within minutes.
- Recovery: Co-op restored services around 14 days after rebuilding key infrastructure. M&S expected online disruption to continue into July 2025 after an April intrusion.
- Disclosure: Caesars determined on 7 September 2023 that data had been taken and filed its 8-K on 14 September 2023.
How the attacks work, from advisories
Advisories rarely give counts, but they are consistent about technique, and that consistency is itself useful evidence for control design.
| Source and date | Caller pretext | What the help desk was asked to do | Recommended control |
|---|---|---|---|
| CISA and FBI, AA23-320A, November 2023 | Posing as company IT or help desk staff to employees; posing as employees to the help desk | Reset passwords and/or MFA tokens; the advisory notes abuse of contracted IT help desks | Phishing-resistant MFA (FIDO/WebAuthn or PKI) |
| Okta, August 2023 | Callers targeting highly privileged users | Reset all MFA factors for Super Administrator accounts, then add an attacker-controlled identity provider | Visual verification at the help desk; keep help desk roles away from privileged admin groups |
| HHS HC3, Sector Alert 202404031000, April 2024 | Employee in a financial role, calling from a local area code, holding SSN last four digits and corporate ID; "phone broken" | Enrol a new device for MFA, followed by ACH payment diversion | Callback to the number on record, in-person appearance or supervisor confirmation |
| NCSC, May 2025 | Retail incidents; social engineering of help desks reported in the press | Password resets, especially for escalated privileges | Review how the help desk authenticates staff before resets; watch Domain Admin, Enterprise Admin and Cloud Admin accounts |
| Microsoft, July 2025 | Octo Tempest impersonating a user to service desk support by phone, email and messages | Initiate a password reset on the target's credentials | Activity in retail, food services, hospitality and insurance (April to July 2025), then airlines |
The pattern across every source is the same: the caller does not break authentication, they ask the organisation to replace it. ATT&CK v20 tracks the call itself as T1566.004 Phishing: Spearphishing Voice, and the outcome usually becomes T1078 Valid Accounts. The group behind several of these incidents is profiled in the Scattered Spider Threat Actor Profile.
What the numbers mean for controls
- Knowledge-based verification is not a control against prepared callers: the HHS case callers held SSN fragments and employee IDs, and the Co-op caller answered security questions. Move resets to verification the caller cannot research: a callback to the number on record, manager approval through a separate channel, or identity proofing aligned to NIST SP 800-63A-4. See the NIST SP 800-63A-4 identity proofing guide.
- Privileged accounts need a separate path: Okta and the NCSC both single out administrator accounts. Do not let the general help desk reset administrator MFA at all; route those requests to a small team with stronger checks.
- Outsourced desks inherit your risk: three of the five cases (Caesars, Clorox and Marks and Spencer) involve a third party. Contract for your verification procedure, audit compliance with call samples, and require notification to the user and manager on every reset, the step Clorox alleges was skipped.
- Phishing-resistant MFA changes the economics: CISA recommends FIDO/WebAuthn or PKI-based MFA because it resists push bombing and SIM swaps. It does not remove the reset problem, since a reset re-enrols a factor, so pair it with strict re-enrolment rules.
- Detection time matters more than prevention claims: with about an hour between reset and misuse in the Co-op case, alerting on a fresh reset followed by a new device, new location or privileged action is what limits damage.
The written procedure for all of this is in the Help Desk Identity Verification Policy Template, and the broader design of recovery flows is in the Account Recovery and Help Desk Security Guide.
Measuring your own help desk
Public data cannot tell you your own exposure. These measures, taken from the service desk tool and identity provider logs, give you a baseline you can trend and compare with the public figures above.
| Metric | How to collect it | Direction |
|---|---|---|
| Resets of password or MFA per 1,000 users per month | Service desk tickets joined to identity provider reset events | Stable or falling as self-service with strong proofing grows |
| Share of resets verified by a method the caller cannot research | Ticket field recording the verification method | Towards 100 percent |
| Privileged account resets handled outside the privileged path | Reset events for members of admin groups, by handling team | Zero |
| Failed or abandoned verification calls | Calls that ended when a callback or manager check was required | Track as a likely attack indicator; review spikes |
| Time from reset to first sign-in from a new device or location | Identity provider sign-in logs | Short gaps on sensitive accounts trigger review |
| Simulated vishing pass rate | Authorised tests of the help desk against the written procedure | Rising |
For the detection side of fresh resets and new MFA enrolments, see the MFA Fatigue and Bypass Guide.
Common failure patterns
- Citing incident costs as frequency: a $100 million loss shows severity. Pair it with survey prevalence and your own reset data in a business case.
- Quoting lawsuit figures as fact: Clorox's $380 million is a claim in litigation that Cognizant disputes. Say so when you cite it.
- Using third-party statistics roundups: help desk figures repeated without a source are common. Use the filing, survey or advisory itself.
- Measuring awareness, not verification: training completion rates say little about whether a reset was verified by callback or manager approval.
- Leaving outsourced desks out of the numbers: if a provider runs resets, its call and verification data belongs in your metrics.
Framework mapping
| Framework | Reference | Relevance to help desk resets |
|---|---|---|
| NIST CSF 2.0 | PR.AA-02, PR.AT-01, GV.SC-05 | Identity proofing bound to credentials, staff awareness, supplier requirements for outsourced desks |
| NIST SP 800-53 Rev. 5 | IA-5, IA-12, AT-2, SA-9 | Authenticator management on reset, identity proofing, awareness, external service providers |
| NIST SP 800-63B-4 and 800-63A-4 | Account recovery and identity proofing | Recovery and re-proofing requirements that replace knowledge-based checks |
| ISO/IEC 27001:2022 Annex A | 5.17, 6.3, 5.21 | Authentication information, awareness training, ICT supply chain |
| MITRE ATT&CK v20 | T1566.004, T1078 | Voice phishing and the resulting use of valid accounts |
Practitioner checklist
- Cite each statistic with its publisher, report name and year, from the primary source.
- Label lawsuit and estimate figures as claims or estimates when you use them.
- Pull your own reset volume and verification method data before writing a business case.
- Replace knowledge-based questions with callback, manager approval or proofing the caller cannot research.
- Route privileged account resets to a separate team with stronger checks.
- Write your verification procedure into outsourced help desk contracts and audit call samples.
- Notify the user and their manager on every password or MFA reset.
- Alert on a fresh reset followed by a new device, new location or privileged action.
- Refresh these figures when new editions of the UK survey, the FBI IC3 report and the Verizon DBIR appear.
Standards and references
- DSIT: Cyber Security Breaches Survey 2025
- FBI IC3: Internet Crime Report 2024
- CISA and FBI: Scattered Spider advisory AA23-320A
- HHS HC3: Social Engineering Attacks Targeting IT Help Desks in the Health Sector
- MGM Resorts International: Form 8-K, October 2023
- Caesars Entertainment: Form 8-K, September 2023
- UK Parliament: Business and Trade Sub-Committee oral evidence from Co-op
- Marks and Spencer: Full year results 2024/25
Related NHI Mgmt Group resources: Help Desk Social Engineering Incident Playbook · Vishing and Help Desk Social Engineering Awareness Guide · Account Recovery and Help Desk Security Guide · Help Desk Identity Verification Policy Template