M&S's chairman told UK MPs the April 2025 attack began with an impersonation of someone with access to company systems, which led a third party to reset an employee's password. The lesson is narrow and practical: treat identity checks at password reset as a security control, including when the help desk is outsourced.
What was said under oath
On 8 July 2025, Chairman Archie Norman gave evidence to a UK Parliament sub-committee. He said initial access happened on 17 April 2025 and came through a sophisticated social engineering attack that involved a third party. M&S shut down parts of its systems to limit the spread, and he said it chose not to speak to the attackers directly, using professional intermediaries instead.
He declined to say whether a ransom was paid, calling it a business decision. He also said rebuilding is needed once systems are compromised, whatever happens with the ransom.
What is reported but not confirmed
Press reports named an outsourced IT provider as the third party involved. BleepingComputer, quoting an earlier Financial Times report, said that provider was investigating its own possible role and was believed to have been tricked, but it described this as unconfirmed. We have not seen an official finding that settles it, so this post does not assign fault to any named company.
The same article says Scattered Spider-linked actors deployed DragonForce ransomware, and that unnamed sources mentioned stolen data and encrypted virtual machine hosts. Treat those as press reporting, not confirmed facts.
Why the help desk is an attractive door
A help desk exists to get locked-out people working again quickly. That is exactly what an impersonator wants: a friendly voice that can reset a password or enrol a new authentication device. The attacker does not need an exploit if the process will do the work.
Outsourcing adds a gap. The people answering may not know the staff, and the verification questions they use may rely on facts that are easy to find or buy. Norman's own remark that M&S has a wide attack surface, including staff and contractors in many places, is a fair summary of the problem.
Controls worth checking this week
- Write down what a help desk agent must verify before a reset, and make "I am in a hurry" a reason for more checks, not fewer.
- Require a call back to a number held in your HR system, or a manager approval, for any reset of a privileged account.
- Treat adding a new multi-factor device as a higher risk event than a password reset, and alert on it.
- Give outsourced agents reset rights only for low privilege accounts. Admin and finance accounts get a separate path.
- Log every reset with the agent, the caller claim and the method used, then review a sample monthly.
- Prefer phishing resistant sign in methods where you can, so that a reset alone does not hand over a session.
None of these needs new tooling. They need a written process and someone who owns it.
Limit what a stolen account can reach
Norman said many of M&S's systems were old and hard to segment, so large parts were switched off. You may not be able to fix that quickly, but you can shrink the blast radius of one account. Review which standard user accounts can reach hypervisors, backup consoles and directory services, and cut anything that does not need to be there. Keep an offline copy of backups and test restoring from it.
For a related case with a similar entry point, see the Co-op help desk incident. For the wider question of what to do when a supplier is the weak link, read the first 48 hours checklist.
Safeguard does not replace a help desk process. It can help on the code and supply chain side, with asset discovery, policies and gates, and a free scan at gold.safeguard.sh/scan, so that fewer of your own systems are easy to reach once someone is inside.
Quick check
Was the help desk provider at fault?
Not established. Press reports say an outsourced provider was investigating its role, but BleepingComputer describes the link as unconfirmed, and no official finding was found when this post was written.
Did M&S pay a ransom?
Unknown. The chairman declined to say when asked by MPs.
What is the cheapest fix?
A written verification standard for resets, with a call back or manager approval for privileged accounts.
Sources
- BleepingComputer: M&S confirms social engineering led to massive ransomware attack
- Infosecurity Magazine: M&S chairman declines to confirm if ransom payment was made
Last reviewed: 19 October 2026.
