the caller who knows the answers

Every company eventually builds a way for locked-out people to get back in. Someone forgets a password, loses a phone, starts a new laptop without the authenticator app. They call IT, or the outsourced help desk, and a few minutes later they are working again. That service is one of the kindest things IT does, and it is also the place where your company hands an account to whoever is on the phone.

The group that governments call Scattered Spider has made that call its main way in. In July 2025 CISA, the FBI and partner agencies in the UK, Canada and Australia updated their advisory on the group to describe it posing as employees to convince help desks to reset passwords and move second factors to devices the attackers control.

what the calls have cost

Clorox, 2023. In a lawsuit filed in July 2025, Clorox alleges that its outsourced help desk, run by Cognizant, reset passwords and second factors for an attacker who simply asked, without the checks the contract required. Clorox puts its damages at about $380 million, according to Reuters. Cognizant disputes the claims and says it provided a narrow help desk service. These are allegations in an open case. The incident is in the Clorox and Cognizant case.

Caesars, 2023. In an 8-K filing on 14 September 2023 Caesars said the attack began with social engineering against an outsourced IT support vendor. The case is in the Caesars incident.

MGM Resorts, 2023. MGM has not described the entry point. The attackers claimed they got in by calling the help desk, according to TechCrunch. In an 8-K filed on 5 October 2023 MGM estimated an impact of about $100 million on its adjusted property earnings for the quarter. The case is in the MGM incident.

Marks & Spencer, 2025. On 8 July 2025 the M&S chairman told a UK parliamentary committee that the attackers got in through sophisticated impersonation and that a third party was involved in the point of entry, according to Claims Journal’s report of the hearing. The case is in the Marks & Spencer incident.

what a reset call checks, and what an attacker brings

what the desk asks

facts about the employee

• Full name and employee ID
• Manager's name and department
• Date of birth or start date
• The last four digits of something

where an attacker finds it

the same facts, from outside

• LinkedIn and the company website
• Org charts in old slide decks
• Breached data sold online
• An earlier call to a different agent

A reset that checks facts about a person can be passed by anyone who has researched the person.

why the help desk is the weak point

It is measured on speed. Help desks are judged on how quickly they close tickets and how happy callers are. A caller who sounds stressed and senior is exactly the case the desk was built to help.

Its questions have public answers. Name, manager, department, employee number. Most of it is on LinkedIn, the rest is in breached data or can be asked for in an earlier call.

It can undo the second factor. Companies roll out two-step login to stop stolen passwords, and the help desk is the one place where both the password and the second factor can be reset in one conversation. That is what the CISA advisory describes.

It is often someone else’s staff. Clorox, Caesars and, by its chairman’s account, M&S all involved an outside party in the entry point. Your verification rules only hold if the vendor follows them on every call, and the contractor guide covers how little most companies see of that.

what narrows it

Call back on a number you already have. Mandiant’s recommendations against this group include calling the employee back on the number registered in your systems before any reset. A caller who is not the employee cannot answer that call.

See the person, with their ID, for high-risk resets. Mandiant also recommends verification on camera or in person, with an identity document, for resets of second factors and of privileged accounts. For a company of a few hundred people that can be the manager on a video call who knows the employee by sight.

Treat admin accounts differently. The UK’s National Cyber Security Centre, after the retail attacks in spring 2025, advised reviewing help desk password resets, especially for accounts with escalated privileges. Decide that resets for administrators never happen on an inbound call.

Tell the employee when their account changes. Send a notification to the old email and phone whenever a password or second factor is reset. If the real employee did not ask, they are the fastest alarm you have.

Write it into the vendor contract, and test it. If an outside company runs your help desk, put the verification steps in the contract and ask, once a quarter, for a sample of reset calls and how each caller was verified.

the question to take to your team

If someone called your help desk tonight as your finance director, what would they need to know to get the account, and how long would it take them to find it?