The next data breach may start with a conversation

This article is an update to our previous article, Cyber extortion has evolved. It’s no longer just about locked systems.

Recent reporting on the ASOS breach has sparked discussion about whether impersonation and social engineering may have played a role in the attack. While the details remain under investigation, it serves as a reminder of an increasingly important reality: many significant cyber incidents now begin with people rather than technology.

There is a tendency to think of cyber breaches as the result of malware, sophisticated hacking tools or unpatched vulnerabilities. Yet some of the most high-profile incidents of recent years have involved attackers convincing someone to grant access that they were never intended to have.

In September 2023, attackers breached MGM Resorts International after reportedly impersonating an employee and persuading the company's help desk to reset authentication credentials. The attack caused significant disruption across MGM's operations, including hotels, casinos and booking systems.  Around the same time, Caesars Entertainment disclosed that suspicious activity within its network resulted from a social engineering attack directed at an outsourced IT support provider, ultimately leading to the theft of customer data. Similarly, the 2022 breach of Uber began when an attacker obtained credentials, repeatedly sent MFA prompts and then impersonated IT support to persuade the target to approve access. The attacker subsequently gained access to a wide range of internal systems.

These incidents highlight an uncomfortable truth.

Attackers increasingly do not need to defeat security controls. They need only persuade someone to operate those controls on their behalf.

That is why effective cyber security requires more than technical measures. It requires strong people controls.

This includes:

• Clear governance around password resets, MFA enrolment and account recovery processes.
• Verification procedures that are resistant to impersonation and do not depend solely on information that can be found online.
• Regular, realistic awareness training focused on contemporary social engineering techniques.
• Escalation procedures for unusual or high-risk requests.
• A culture in which employees feel empowered to challenge requests, verify identities and "stop the line" when something does not feel right.

As organisations continue to invest in technical security, equal attention should be paid to governance, awareness and culture.
After all, the critical question may no longer be:
Can someone break into our systems?
But rather:
Can someone persuade one of our people to let them in?