Scenario 04 Illustrative
When Your IT Provider Is Breached
An illustrative breach at a retailer's managed IT provider that puts every store at risk, and how to cut exposure fast and manage vendor access.
Illustrative scenario, not a client engagement. This is a hypothetical example based on common attack patterns. It shows how we'd approach the problem, and doesn't describe a real client, incident or result.
- Sector
- Retail
- Scenario
- Supply chain
- Written for
- Leadership and IT teams
The situation
A regional retailer with 12 stores learns from a news report that its managed IT provider has been breached. The provider's remote management tool is installed on every point-of-sale terminal and back-office computer, and its technicians hold administrator rights to the retailer's Microsoft 365 tenant.
The provider's updates are vague: “We're investigating, and there's no evidence customer environments are affected.” The retailer's leaders don't know what the provider can access, or how worried they should be.
What's at stake
The risks
- Attackers who control a provider's management tools can push ransomware to every client at once. In 2021, attackers exploited Kaseya's VSA software to reach as many as 1,500 businesses through their IT providers, and a Swedish grocery chain had to close hundreds of stores.
- Point-of-sale downtime means lost sales in every store at the same time.
- Payment card data and customer information could be exposed, with PCI DSS consequences.
- The retailer depends on the provider for day-to-day IT, so simply cutting them off isn't easy.
Our approach
How we'd help
- Map access. In the first hours, identify every path the provider has into your environment: remote management agents, VPN accounts, shared passwords and delegated cloud admin rights.
- Reduce exposure. Temporarily disable or restrict that access, rotate shared credentials and increase monitoring on stores and back-office systems.
- Hunt. Look for signs the provider's access was misused: new admin accounts, unexpected scripts, disabled security tools or unusual remote sessions.
- Reset the relationship. Write minimum security requirements, named accounts with MFA, logging and breach-notification deadlines into the contract, and review them regularly.
Decisions for leadership
- Decide whether to suspend the provider's access temporarily, and how stores will keep running if you do.
- Check what the contract says about notification, cooperation and liability, with legal counsel.
- Decide whether to stay with the provider, and what evidence of security you'll require.
- Rank all your suppliers by the access they hold, and review the riskiest first.
Technical notes
- Inventory remote management and remote access tools on every endpoint. Unapproved tools such as AnyDesk or ScreenConnect are common attacker footholds.
- Review partner relationships and delegated admin privileges in Microsoft 365, and remove any that aren't needed.
- Require named, MFA-protected provider accounts with logging, and no shared credentials.
- Alert on new scripts, policies or software deployments pushed through the management tool.
- Segment point-of-sale networks and confirm your PCI DSS scope.
The takeaway
Your suppliers' access is part of your attack surface. Know exactly what they can reach, and be able to switch it off fast.
Related reading
Next step
Could this happen to you?
Tell us what you're protecting. We'll help you find the gaps before an attacker does, and plan how you'd respond if one gets in.
Book a consultationPrefer to talk?