“Stolen credentials are involved in 44.7% of breaches,” a sobering finding from Verizon’s Data Breach Investigation Report that sits at the center of a simple but consequential problem: organizations have made logins harder to bypass, so attackers are increasingly looking for the weakest link around them — account recovery.
Why account recovery matters to MFA
Multi-factor authentication (MFA), conditional access and device trust have raised the cost of turning stolen passwords into full account takeovers. Organizations are moving away from SMS toward authenticator apps, FIDO security keys and passkeys, and phishing-resistant factors have made direct credential theft harder to exploit. But the same protections create an incentive for attackers to bypass the protected login path entirely.
The source describes a variety of alternate routes attackers use: stealing session tokens, abusing existing authenticated sessions, or targeting authentication processes that sit outside the normal login flow. Of those external processes, account recovery is especially attractive because it exists precisely to restore access when an authenticator is lost or damaged.
How the recovery path becomes the attack path
When self-service options fail, the service desk frequently becomes the route back into an account. Depending on configuration and user privileges, a help desk agent may reset a password or MFA, remove an existing authentication method, issue temporary credentials, or approve registration of a new authenticator.
These are necessary support functions — but also sensitive identity-management actions. If callers must prove they own the account but only face simple knowledge-based checks or conversational judgment, the recovery process can become weaker than the MFA it replaces. The source contrasts question-based help desk recovery with identity verification that seeks to "re-establish trust" before access is restored.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleScattered Spider impersonation campaigns and the Marks & Spencer fallout
A joint advisory from CISA, the FBI and international partners singled out tactics used by the hacking collective Scattered Spider: posing as employees to persuade IT and help desk staff to reset passwords and transfer MFA to attacker-controlled devices. The advisory also notes attackers may spend several calls learning an organization’s password-reset process before attempting takeover.
The potential business impact is illustrated by a 2025 incident at Marks & Spencer. According to the source, Scattered Spider impersonated an employee to trick a third‑party contractor into resetting a password, then used that foothold to compromise additional accounts and deploy ransomware across the retailer’s network. M&S chairman Archie Norman told Parliament the incident was expected to reduce profit by around £300 million before recoveries.
Microsoft’s Entra ID and the shift to “high‑assurance” recovery
Recognizing the identity-assurance element of recovery, Microsoft describes account recovery in Entra ID as a “high-assurance” process and contrasts traditional question-based help desk recovery with stronger identity verification designed to re-establish trust. The framing is explicit: the process used to replace an authentication method should provide confidence that the person requesting the change is the account owner.
Put bluntly, enriching login security without doing the same for reset and recovery workflows leaves a measurable attack surface inside normal support operations.
Specops Secure Service Desk: verification at the point of risk
The source presents Specops Secure Service Desk as a product designed to make identity verification a required part of sensitive service desk workflows. According to the material, the solution can use existing identity data in Active Directory or Entra ID and integrates with authentication services including Duo, Okta, PingID and Symantec VIP. It reportedly supports more than 15 MFA factors so service desks can verify different types of users without separate enrollment.
Crucially, verification is positioned to sit directly in front of high‑risk actions: agents can reset passwords, unlock accounts and require a password change at next logon only after the caller has been successfully verified. The product also allows verification events to be exported to SIEM and analytics platforms to support audit and SOC workflows.
What this means for technologists, procurement leaders, and end users
- Technologists and security teams: Treat the service desk as part of the identity security boundary. The verification step before resets is as important as the MFA technology it replaces during normal use, the source argues.
- Procurement and enterprise leaders: The Marks & Spencer example translates identity-focused social engineering into concrete financial exposure — about £300 million before recoveries in the cited case — reinforcing the argument for investing in stronger verification workflows for support staff.
- End users and support staff: Recovery processes that rely on easily guessed information or agent judgment are high‑risk. The source suggests shifting to verifiable, auditable checks so legitimate support is preserved while reducing social‑engineering windows.
The record laid out here is straightforward: MFA has done its job in many environments, but defenders must secure the paths that exist to replace MFA when legitimate users lose access. Treating service desk verification as part of the identity security process — and putting strong, auditable verification steps directly in front of password resets, MFA transfers and account unlocks — is the specific mitigation the source recommends to reduce the risk that the recovery path becomes the attack path.
