|
 |
Key Takeaways
The Transport for London and Marks & Spencer cyber attacks demonstrate how modern attackers increasingly prioritise identity compromise and social engineering over traditional exploitation techniques.
Both incidents highlight that highly disruptive cyber attacks no longer require advanced malware or previously unknown vulnerabilities. Compromising trusted identities can provide attackers with the access they need.
The attacks show similarities in attacker behaviour, including the targeting of human processes, abuse of legitimate access and the use of existing administrative tools after gaining entry.
The incidents also demonstrate important differences. TfL primarily exposed the risks of identity compromise within a public service environment, while the M&S attack showed how a retail organisation can suffer prolonged operational and financial disruption from a similar class of intrusion.
Security teams should increasingly focus on identity resilience, privileged access management, help desk security, third-party risk and business continuity alongside traditional technical controls.
#243: The Entrepreneurial Adversary | ||||||
| ||||||
 | ||||||
A Complimentary Pen Test from the Team That Tests the Whole Product | ||||||
|
Cybersecurity incidents are often analysed individually. A breach affecting a transport organisation is viewed as a critical infrastructure problem, while an attack against a retailer is treated as a business continuity issue. However, examining major incidents together often reveals broader trends that are less obvious when each event is considered in isolation.
The cyberattacks affecting Transport for London (TfL) and Marks & Spencer (M&S) provide a useful comparison because they represent two different organisations facing a similar style of modern threat. One operates a public transport network used by millions of people, while the other manages one of the UK’s most recognisable retail brands. Despite the differences in their missions, both incidents demonstrate how attackers increasingly target identity, trust and operational processes rather than relying solely on technical exploitation.
The attacks also challenge some long-standing assumptions about cybercrime. Significant disruption has historically been associated with highly advanced adversaries using sophisticated malware or previously unknown vulnerabilities. Recent incidents suggest a different reality. Attackers can achieve substantial operational impact by combining social engineering, stolen credentials, legitimate administrative access and knowledge of how organisations function.
The most important lesson from both incidents is that modern cybersecurity is increasingly about protecting trust. Organisations no longer operate within clearly defined network boundaries, and attackers understand that compromising a legitimate identity can provide more value than attempting to bypass technical controls directly.
The Transport for London Cyber Attack
Transport for London disclosed in September 2024 that it had experienced a cyber incident affecting parts of its n