https://www.retailgazette.co.uk/blog/2025/06/ms-cyber-attack-deepens
https://www.techradar.com/pro/security/mystery-of-m-and-s-hack-deepends-as-tcs-claims-none-of-its-systems-were-compromised
[EDITED: ‘Impacted Party] employee here – using a throwaway account for obvious reasons, so don’t expect replies.
I’m absolutely fed up with seeing TCS (Tata Consultancy Services) in the media trying to spin this situation and deny any responsibility. I’m [EDIT: Experienced] in IT – and I have never seen a supplier show so little accountability for a failure of this scale.
Let’s be clear: TCS are not the impacted party here. That much is true, and that’s what they’re trying to draw everyone’s attention towards as though it gets them off the hook …they are the entry point. They don’t own the houses, but they’re the maintenance workers who are unlocking all the doors for the burglars.
Their service desk and security practices were the weak link that attackers exploited, and their refusal to take responsibility is actively putting other organisations at risk. Instead of addressing the root causes, they’re focused on controlling the narrative – while making zero meaningful changes to prevent this from happening again.
We’ve been advised not to speak publicly due to ongoing legal action related to the investigation, but their latest public statement has crossed a line. So, let me spell out exactly how this attack unfolded – because it’s critical that other businesses understand just how dangerous this provider’s failings have become.
TCS was the real target: not us. We, alongside the other retailers, were the victims… and there is a big difference.
To explain; it’s clear to all those involved internally in these investigations (including Microsoft’s DART and supporting teams who have said this to us multiple times as part of their attack-pattern analysis) that Scattered Spider specifically targeted TCS because of systemic weaknesses in their service desk operations. Once in, they simply pivoted into our environment using the privileged access that TCS handed over without following basic process.
These attackers exploited:
• Untrained or poorly trained service desk staff
• Zero verification of caller identity
• No adherence to basic security protocols, even when asked repeatedly by clients
• No oversight or effective quality assurance on their support processes
Early in the investigation, we requested TCS send us call recordings for the first few identified social engineering attempts we were able to trace. Just the first 4… The recordings they sent us – without even reviewing them first – were jaw-dropping.
In 3 of 4 calls, the service desk reset passwords and re-enrolled MFA with zero resistance. The caller simply gave a name – no validation, no callback, no check. On the 4th call, the attacker requested access to a privileged group. The TCS agent asked for an employee ID. The ID given didn’t even match our company’s format; and yet, the access was granted anyway.
That’s four out of four security failures.
When we requested the rest of the call logs (we know over 100 such calls were made), TCS stalled for days. Eventually, a senior manager claimed the recordings were either lost or deleted. Yes – they said both.
TCS is now publicly claiming that their systems weren’t breached … as if that excuses the fact that their people and processes were the compromised layer. This is a textbook case of supply chain failure. The attackers didn’t need to hack anything. TCS handed them the keys.
And in some cases, they’re not just managing access: they’re also responsible for monitoring security operations. Yet they completely missed the post-breach attacker activity. Why? Because their SOC services are just as ineffective.
Even after all this, a member of our team called the TCS desk from a personal phone, impersonated a colleague, and was able to reset their password … again, with no challenge.
They’ve learned nothing. Their focus remains on PR damage control rather than remediation, and that is simply unacceptable.
This isn’t just a [EDIT: Impacted Party] issue. Any organisation using TCS for access or security support should be asking serious questions right now. These attackers are going through TCS to get to you … and TCS isn’t stopping them.
They failed. They know it. And now they’re trying to bury it.
[EDIT: helpful Redditor told me to remove my company affiliation so it doesn’t get pulled by mods for self-doxing. Thanks for the note!]