'Major compromise' at NHS temping arm exposed gaping security holes

In May 2024 NHS Professionals was breached after a compromised Citrix account allowed attackers to escalate privileges to domain admin, move laterally via RDP/SMB/WinRM, and likely exfiltrate the Active Directory database (ntds.dit). Deloitte's incident report documents attempted deployment of Cobalt Strike beacons and other binaries, identifies critical security gaps (lack of MFA on domain accounts, incomplete EDR coverage, limited log retention), and describes remediation actions (AD take-back, password/certificate rotation, disabling Citrix drive mapping) while noting attribution was inconclusive.