馃What Was the Human Error?
The breach occurred when cybercriminals, believed to be the group Scattered Spider, impersonated M&S staff and deceived IT help desk agents into resetting internal credentials. This manipulation granted the attackers unauthorized access to M&S鈥檚 systems.
Additionally, reports suggest that the attackers stole an NTDS.dit file, a critical database containing encrypted employee passwords for M&S鈥檚 Windows network. If decrypted, these passwords could have allowed the attackers to move laterally across the network using legitimate-looking credentials.
馃敁Why Was M&S Vulnerable?
Several factors contributed to the vulnerability:
路 Third-Party Supplier Exploitation: The attackers targeted a third-party supplier, bypassing M&S鈥檚 internal security measures.
路 Lack of Cyberattack Preparedness: An internal source revealed that M&S lacked a business continuity plan for such incidents, leading to a reactive response.
路 Inadequate Email Security: M&S did not have a DMARC policy set to 鈥渜uarantine鈥� or 鈥渞eject,鈥� making their email domain more susceptible to spoofing and phishing attacks.
