Regular Password Resets Aren’t as Safe as You Think

**Executive summary:** The report recounts an April 2025 attack on Marks & Spencer in which attackers linked to Scattered Spider used a social-engineered password reset via a third‑party service desk to obtain credentials, extract Active Directory NTDS.dit, crack hashes, escalate privileges, and deploy ransomware that disrupted online sales for five days; it promotes Specops Secure Service Desk and outlines best practices for hardening password reset processes.