Threat Intel
Identity as the New Network Perimeter: Lessons from Recent Retail Ransomware Breaches
High‑profile UK retailers M&S and Co‑op Group fell victim to ransomware after attackers harvested corporate passwords via vishing. The incidents underscore how credential abuse fuels breaches in today’s distributed environments. Defenders must harden identity controls, monitor for infostealer activity, and enforce MFA to stop attackers before they gain footholds.
What Happened
In December 2025, Marks & Spencer and Co‑op Group were hit by ransomware after attackers obtained corporate passwords through vishing campaigns. The stolen credentials allowed the extortionists to move laterally and encrypt critical data, forcing the retailers to pay a combined ransom exceeding £500 million.
Impact
The breaches caused significant financial loss, disrupted operations, and eroded customer trust. They also highlighted that credential abuse accounted for 22 % of data breaches last year, according to Verizon.
Why Identity Is the New Perimeter
Modern enterprises rely on cloud services, remote laptops, and mobile devices, diluting the traditional network moat. Credentials now serve as the primary gatekeeper, making infostealer malware, phishing, smishing, and vishing the most effective ways to acquire them.
“Credential abuse is the most common vector in modern breaches.” – Verizon 2024 report
What Defenders Should Do
- Enforce multi‑factor authentication for all privileged and remote accounts.
- Deploy endpoint detection that flags infostealer signatures and anomalous credential‑exfiltration.
- Implement continuous user‑behavior analytics to spot lateral movement.
- Conduct regular phishing simulations and security awareness training focused on vishing.
- Segment networks and apply least‑privilege access controls to limit damage from compromised accounts.
Related articles
NDR Blind Spot: Why Perimeter‑Focused Monitoring Misses Lateral Attacks
Recent analysis shows that most Network Detection and Response (NDR) solutions concentrate on perimeter traffic, leaving east‑west movement—the primary vector in modern breaches—unmonitored. Defenders must extend visibility into internal flows, integrate threat intelligence, and adopt XDR‑style correlation to detect lateral activity early.
Read briefing
Booz Allen Demonstrates AI Agents Rapidly Compromise OT Networks in Lab
In a controlled lab, Booz Allen’s AI models breached an isolated industrial control network from a perimeter entry in just over 16 minutes, moving physical equipment and adapting to obstacles. The exercise shows the speed and adaptability of current AI‑driven adversaries, underscoring the need for hardened OT perimeter defenses and continuous monitoring.
Read briefing
Social Engineering Detection Grows Beyond Awareness Training
Security awareness programs are widely deployed, yet evidence shows they fail to stop social engineering. Recent high‑profile breaches—Las Vegas casinos, MGM Resorts, Caesars Entertainment—highlight the limits of user training and the rise of AI‑powered deception. Defenders must shift from training to detection, MFA enforcement, and deepfake monitoring.
Read briefing
Weekly Threat Briefing: Autonomous AI Intrusion, Critical Zero-Days in SonicWall, and High-Impact Enterprise Breaches
Recent threat intelligence highlights alarming developments in cybersecurity, including enterprise network compromises executed by AI agents in under ten hours, critical zero-day vulnerabilities in SonicWall SMA gateways and CrowdStrike Falcon, and widespread data breaches affecting Dropbox, Thomson Reuters, and medical providers.
Read briefing