Security for Marketing Teams: Martech, Social Accounts and Customer Data

Marketing teams hold the organisation's public voice, much of its customer data and dozens of SaaS logins, yet security rarely treats them as a high-risk group. A marketer can publish to millions of followers, change the website, spend the advertising budget, export the customer list and add a script that runs on every page, often from a personal phone and through an agency. Attackers know this: infostealer campaigns such as DUCKTAIL went after digital marketing staff specifically to hijack business advertising accounts. This guide covers the people side of marketing security: who holds which account, how to run social and ad platforms safely, website scripts and tags, customer lists and consent, agencies and freelancers, and how to measure the result. It is for marketing operations leaders, martech owners and the security and privacy teams that support them. AI agents doing marketing work are covered separately in the AI Agents in Marketing Guide, which this page does not repeat.

Source note: platform roles, NCSC, ICO, FBI IC3 and PCI SSC points below are summarised from the official pages listed in the references, as checked in November 2026. Platform role names and regulator guidance change often. Confirm against the official text before relying on it.

Key takeaways

• Publishing and spending are privileged actions. Treat brand social accounts, ad accounts, the CMS and the tag manager as privileged systems with named owners, least-privilege roles and at least two administrators.
• Marketers are targeted for their access, not their data. Lures about brand collaborations, job offers and ad policy violations aim to steal session cookies and add the attacker as an admin on business accounts.
• The website is part of the marketing estate. Every tag and third-party script added through a tag manager runs with full access to the page, so publishing rights there need the same approval as code.
• Customer lists are the crown jewels. Exports to spreadsheets, agencies and new tools are where marketing data leaks; route them through approved tools with logging and retention limits.
• Agencies need their own identities. Use partner or business-to-business access features and named agency accounts, never shared logins, and remove access on the day a contract ends.

Why marketing is a high-value target

Marketing combines authority and reach. The team controls channels that customers trust, holds the contact details and behavioural data for every prospect and customer, and buys SaaS tools faster than most departments. The table sets out the main assets and what an attacker gains from each.

The pattern is not theoretical. WithSecure's research on DUCKTAIL describes an infostealer delivered through LinkedIn to managerial, digital marketing, digital media and HR staff with access to Facebook business accounts; it stole browser cookies and used the live session to add the attacker's email address to the business with Admin and Finance editor roles. The Mailchimp breach showed the supplier side: staff credentials obtained by social engineering gave an attacker an internal tool that exposed customer audience data and API keys.

The lures that reach marketers

Awareness for marketing should use the lures this team actually receives, not generic invoice phishing. These are the recurring themes.

• Brand collaboration and sponsorship: a "partner" sends a brief, media kit or contract as an archive or a link to a file share. The file is malware that steals browser cookies and saved passwords (T1566.002 Spearphishing Link, T1566.003 Spearphishing via Service when delivered by LinkedIn or another platform's messaging).
• Ad policy and account suspension: a message claims the page or ad account will be disabled unless the admin "appeals" on a linked form that captures credentials and 2SV codes.
• Job offers and freelance gigs: recruiters for marketing roles who need you to "complete a test task" by downloading a file.
• Fake platform support: calls or direct messages from someone claiming to be the social network, the ad platform or the martech vendor, asking for a code or for approval of an app connection. The ShinyHunters Salesforce campaign worked this way against customer-facing staff.
• Malicious search ads: the FBI's IC3 warned in public service announcement I-122122-PSA (21 December 2022) that criminals buy search ads on lookalike domains to impersonate businesses and push fake downloads. Marketers searching for a tool's download page are exposed, and so are your customers searching for your brand.

The one rule that defeats most of these: no platform, vendor or partner will ever need your 2SV code, a connection code or approval of an app over the phone or in a message. Report it instead. See the Infostealer Executive Briefing for why stolen session cookies bypass passwords and many forms of MFA.

Running social and ad accounts safely

The NCSC's guidance on protecting what you publish sets the baseline for organisational social media: switch on 2SV for social platforms and the management tools that publish to them, avoid shared passwords (and where sharing is unavoidable, use a password manager that audits access), turn on access logging, revoke access when staff leave or move, know the recovery process before you need it, and create and publish content on corporate devices where possible. It also says that if an account is compromised, regaining control comes before correcting malicious posts. The platform-specific setup for small organisations is in the Social Media Account Security for Small Businesses Guide; the points below are what changes when a whole team and its agencies share the accounts.

Ownership and roles

• Business ownership, not personal ownership: each brand page and ad account belongs to a business account (for example a Meta business portfolio or a Google Ads manager account) that the organisation controls, with the recovery email set to a monitored role mailbox, not a person.
• Two administrators, no more than needed: keep at least two named admins so the account survives an absence, and give everyone else the lowest role that does the job.
• Separate billing from publishing: Google Ads, for example, documents distinct Email-only, Read-only, Billing, Standard and Admin access levels; only Admin can grant access, change access levels and review each user's authentication method and last login time. Use Standard for campaign managers, Billing for finance, and keep Admin rare.
• Phishing-resistant sign-in for admins: where a platform supports passkeys or security keys, require them for administrators. See the Phishing-Resistant MFA Guide.

Role names differ between platforms, so map each column to the platform's own role list. The principle is fixed: the people who draft are not the only people who can publish, and the people who spend are not the people who grant access.

Approval and devices

Use the workflow and approval features in your social media management tool so posts pass a second pair of eyes, and keep that workflow during a crisis, which is when bypasses happen. Publishing apps on personal phones are the hardest access to revoke quickly: enrol them in mobile application management or limit publishing to managed devices. See the Social Media Account Takeover Playbook for the response steps.

The website, tags and third-party scripts

Marketing usually owns the tag manager and adds analytics, pixels, chat widgets and A/B testing scripts. Every one of those scripts runs in the visitor's browser with the same access as your own code, including to form fields on login and checkout pages. That makes tag publishing a change to production software.

• Use the permission tiers: Google Tag Manager separates container permissions into Read, Edit, Approve and Publish, plus account-level Admin and User. Give agencies and most marketers Edit, a small group Approve, and Publish only to people who review the change. See the Google Tag Manager Security Guide.
• Keep a script inventory: list every third-party script, its owner, its purpose and the pages it runs on. Remove tags for finished campaigns.
• Protect payment pages: PCI DSS v4.x requirements 6.4.3 and 11.6.1 expect scripts on payment pages to be authorised, integrity-checked and monitored for unauthorised change. Marketing tags should not load on checkout pages at all unless they are on that inventory. See the Client-Side Security Guide.
• CMS accounts: named accounts with MFA, editor rather than administrator for content staff, and plugin installation reserved for the web team.

Customer data, lists and consent

Marketing processes personal data at scale, so data protection law shapes how it may be collected, used and shared. In the UK, the ICO's PECR guidance says organisations must not send marketing emails or texts to individuals without specific consent unless the soft opt-in applies (existing customers who bought or negotiated to buy a similar product, with a simple opt-out offered at collection and in every message), that soft opt-in does not cover bought-in lists, and that senders must identify themselves and provide a valid opt-out address. The ICO notes this guidance is under review following the Data (Use and Access) Act, so check its current text. Cookie and tracker rules are covered in the Consent Management Guide.

Security's concern is where the data goes.

Data minimisation applies directly: delete old campaign lists and expired leads rather than keeping everything for "future targeting". See the Data Minimisation guide.

Where identity fits

Marketing runs on non-human identities that nobody in the team thinks of as identities: API keys for the email platform, OAuth grants that connect the CRM to the automation tool, webhooks for form handlers, system users for ad platform reporting. When the person who created them leaves, the key keeps working. Inventory these with owners, use platform system users or service accounts rather than a person's login, scope them to the minimum and rotate them when people leave. See the SendGrid, Mailgun and Mailchimp API Keys Security Guide and the SaaS and OAuth App Governance Guide. The Salesloft Drift breach began with OAuth tokens held by a marketing chat integration.

Agencies, freelancers and partners

• Give the agency its own identities: use partner features (agency business accounts, manager accounts linked to yours) so access is granted to named assets and can be removed in one place.
• Named people, not shared logins: require the agency to use individual accounts with MFA, and ask for its leaver process.
• Scope by asset and task: an agency running paid search needs the ad account, not the social pages, CMS admin or customer exports.
• Contract terms: security and deletion clauses, incident notification, no subcontracting without approval. See the Security for Procurement Teams Guide.
• End-of-contract review: remove every agency user, token and partner link on the last day and confirm in writing.

Implementation: a phased rollout

The phases and timings below are NHI Mgmt Group recommendations.

1. Inventory (weeks 1 to 3): list every marketing platform, who holds admin, the recovery email and phone, agency access and API keys.
2. Fix ownership (weeks 3 to 6): move pages and ad accounts into business accounts the organisation controls, set two admins, replace personal recovery details with role mailboxes, and remove leavers.
3. Turn on strong sign-in (weeks 4 to 8): enforce 2SV for everyone and phishing-resistant methods for admins where supported. Pilot with the social team first.
4. Separate duties (weeks 6 to 10): apply the role matrix, split billing from admin, and set tag manager Publish rights to a small reviewed group.
5. Lock down data exports (weeks 8 to 12): reduce export rights, switch on export logging, and agree a retention date for extracts.
6. Train with real lures (ongoing): a 30-minute role-based session using collaboration, ad suspension and fake support lures, repeated twice a year. See the Role-Based Security Training Programme Guide.
7. Rehearse recovery: run a tabletop of a hijacked brand account. Rollback for each change is simple (restore a removed role), so keep a dated record of every permission change in case a campaign breaks.

Decision guidance

The guidance below is NHI Mgmt Group's recommendation.

• Small team, one or two marketers: focus on 2SV on every account, a password manager, business ownership of pages and a second admin (for example the managing director).
• Mid-size team with agencies: add the role matrix, partner access, tag manager approval and quarterly access reviews.
• Large or regulated organisation: bring marketing platforms under single sign-on where the platform supports it, add them to identity governance access reviews, and feed platform logs to the SOC.
• Shared login unavoidable: some smaller platforms have no multi-user model. Keep the credential in a password manager with access logging and rotate it when anyone with access leaves, as the NCSC advises.
• Speed versus control: marketing will resist approval steps that slow publishing. Put approvals on publishing to brand channels and tag changes, not on drafting, scheduling or reporting.

Detection and measurement

Monitor admin and role changes on business accounts, new partner or agency links, new ad payment methods or sudden spend increases, new API keys and OAuth grants on marketing platforms, large audience exports, tag manager publishes outside change windows, and new lookalike domains. The Domain Portfolio and Lookalike Domain Management Guide covers domain monitoring.

Common failure patterns

• The founder's personal account owns the page. When that person leaves or is phished, the organisation cannot recover the account without the platform's help.
• Everyone is an admin. Admin rights handed out to "save time" mean one stolen session can add an attacker as a further admin, which is how DUCKTAIL operated.
• Agency access never removed. Former agencies keep ad, CMS and tag manager rights for years after the contract.
• Tags published without review. A campaign script added directly to production loads on checkout pages and is later compromised at its source.
• Exports everywhere. Customer lists sit in personal drives, email attachments and trial tools; the Mailchimp breach shows how quickly audience data leaves once an account is compromised.
• Keys tied to a person. Integrations break when the creator leaves, so someone shares their login instead of fixing the identity.

Framework mapping

Practitioner checklist

• Inventory every marketing platform with its admins, recovery details, agency access and API keys.
• Move brand pages and ad accounts into organisation-owned business accounts with two named admins.
• Enforce 2SV for all marketing users and phishing-resistant sign-in for admins where supported.
• Separate billing, publishing and access management roles on ad platforms.
• Restrict tag manager Publish rights and keep a script inventory with owners.
• Limit customer export rights, log exports and set retention dates for extracts.
• Give agencies their own named, scoped access and remove it on the contract end date.
• Replace personal logins in integrations with platform system users or service accounts.
• Run role-based training using collaboration, ad suspension and fake support lures.
• Rehearse brand account recovery with the platform's process documented in advance.

Standards and references

• NCSC: Social media, protecting what you publish
• ICO: Electronic mail marketing (Guide to PECR)
• FBI IC3: Cyber criminals impersonating brands using search engine advertisement services
• Google Ads Help: About access levels in your Google Ads account
• Google Tag Manager Help: User permissions
• PCI Security Standards Council: Payment page security and preventing e-skimming
• WithSecure: DUCKTAIL, an infostealer malware targeting Facebook business accounts

Related NHI Mgmt Group resources: AI Agents in Marketing Guide · Social Media Account Takeover Playbook · Security for Sales Teams · Security Awareness and Human Risk Management Guide