🧠What Was the Human Error?
The breach occurred when cybercriminals, believed to be the group Scattered Spider, impersonated M&S staff and deceived IT help desk agents into resetting internal credentials. This manipulation granted the attackers unauthorized access to M&S’s systems.
Additionally, reports suggest that the attackers stole an NTDS.dit file, a critical database containing encrypted employee passwords for M&S’s Windows network. If decrypted, these passwords could have allowed the attackers to move laterally across the network using legitimate-looking credentials.
🔓Why Was M&S Vulnerable?
Several factors contributed to the vulnerability:
· Third-Party Supplier Exploitation: The attackers targeted a third-party supplier, bypassing M&S’s internal security measures.
· Lack of Cyberattack Preparedness: An internal source revealed that M&S lacked a business continuity plan for such incidents, leading to a reactive response.
· Inadequate Email Security: M&S did not have a DMARC policy set to “quarantine” or “reject,” making their email domain more susceptible to spoofing and phishing attacks.
