how it happened
- whoScattered Spiderreported
- the gappassword resetfor an outsourcing provider's staff
- thenonline systemsorders suspended 46 days
- the result~£300M profit hitexpected
what everyone assumed
Most boards have quietly priced a breach as a reputational event: bad headlines, an apology, a dip in trust that fades. The financial logic feels sound, because the visible cost of past incidents has often been the cleanup and the embarrassment rather than the operating result. The assumption holds right up until the breach stops being about data and starts being about whether the business can take orders. At that point the cost is not reputation. It is revenue that does not arrive.
what happened
The compressed chain has been widely reported. According to that reporting, attackers associated with the group known as Scattered Spider gained entry after a third-party help desk reset a password, using compromised credentials tied to staff at an outsourcing provider. DragonForce ransomware followed. What had begun as a credential reset became control over systems M&S relied on to sell online and to manage stock. The retailer suspended online orders and reverted parts of its operation to manual processes. Each day of that suspension was a day the online business could not transact, and the days accumulated.
step by step
- a third-party help desk resets a passwordCredentials tied to staff at an outsourcer, as reported.the assumption breaks here
- DragonForce ransomware followsSystems for online sales and stock are hit.
- online orders suspendedParts of the operation go manual.
- 46 days later, orders resumeExpected cost about 300 million pounds in lost profit.
how it surfaced
M&S resumed taking online orders for some clothing lines after a hiatus of 46 days. The company said it expected the attack to cost it in the region of 300 million pounds in lost profit, with disruption running for weeks beyond the initial outage. The damage did not land in a leaked database that could be apologized for. It landed in the profit line, in the quarter, in orders that were never placed.
A breach that reaches the systems you sell and operate through is not a reputational event with a financial footnote.
It is a financial event, and the size of it is set by how long you cannot do business, not by how the headlines read.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersAn attacker calls, gets a reset, and launches ransomware from there.what it costs youOnline sales stop for weeks and the lost profit lands in your quarterly results.
- or it goes like thisit happenedMGM Resorts, 2023howA caller poses as an admin and gets a password and code reset in minutes.what leavesadmin control of identity and cloudwho ends up with itattackers who deploy ransomware
- or it goes like thisit happenedClorox and Cognizant, 2023howAn outsourced desk resets an account three times without checking the caller.what leavesa fully working employee loginwho ends up with itan intruder who looks legitimate everywhere
sources
your turn
what you can do about it
this week
Two questions are worth asking together: what proof does your help desk require before resetting access for someone claiming to be staff, internal or outsourced, and if your selling and operating systems went dark, how many days could the business run on manual before the cost stopped being an inconvenience.
Your business has a small number of systems that, if they stopped, would stop revenue with them: the store, the order flow, the stock view. The M&S sequence started at a help desk reset and reached exactly those systems.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →