One Phone Call. 148 Systems. £29 Million.

Two members of Scattered Spider, aged 20 and 18, were sentenced at Woolwich Crown Court in July. Five and a half years each for the 2024 attack on Transport for London- the largest cybercrime prosecution the UK has brought.

148 systems offline, some for weeks. All 27,000 employees pulled in for in-person password resets. Roughly £29 million gone.

The entry point was a phone call. They bought partial employee credentials on a forum, rang the IT help desk, impersonated the employee, and talked a support worker into resetting a password and bypassing 2FA.

That's the intrusion. The sixteen hours after it were escalation.

The equation

Every incident of this class reduces to two terms multiplied together.

Deception- how good the attacker was at convincing someone. Reach- what the identity they compromised could touch.

Now look at where the money went. Deception at TfL was cheap and unremarkable. It's the same call the same crews made at MGM and Caesars in 2023, at UK retailers in 2025, and at a run of airlines and insurers since. It costs little and takes an afternoon, and it will keep working, because it attacks the recovery path rather than the login path- help desk resets, MFA re-enrollment, SIM swaps- and recovery paths terminate in a human being helpful.

So the first term is essentially fixed. It's a constant.

The £29 million was the second term. One talked-through password reset became a path to 148 systems. The court heard the pair spent sixteen hours climbing from that one account, and what an attacker climbs in those hours is always the same material: years of accumulated entitlements, standing privilege and group membership that nobody could see and therefore nobody trimmed.

You will never drive deception to zero. Reach is entirely yours.

Why hardening the help desk doesn't move it

The instinct after this kind of incident is better verification at the desk and better detection behind it. Do both. Neither touches the multiplier.

From the moment that MFA device was enrolled, every access after it was- to the IdP- flawlessly legitimate. Strong authentication on a compromised enrollment is strong authentication for the attacker. There's little anomalous downstream to catch until the escalation is already underway. Detection is hunting a technique that already succeeded three steps earlier.

Which leaves least privilege, which is exactly what governance is supposed to deliver, and mostly doesn't. A design partner described why in one sentence: reviewers approve everything, because they're handed 130 rows of permissions with no indication of what's used.

That's not laziness. It's an unanswerable question. Nobody can adjudicate 130 rows of entitlements they have no context for, so the campaign passes and the creep survives, quarter after quarter, until one reset reaches 148 systems.

Two questions that shrink reach

What can this identity actually touch?

Not what role it was assigned- what it can reach, resolved through nested groups and inherited admin, down to the resource. The classic finding- and it's a pattern, not one customer- is a standard user who can reset any password via three layers of inheritance nobody has examined since 2019. Role assignment tells you what someone was given. Effective permissions tell you what they can do with it. Those are different numbers and only one of them is the blast radius.

How much of it do they use?

Granted versus used is the most productive comparison in identity, and it's unanswerable unless entitlements and activity live in the same graph. That comparison is what role mining actually is: derive the model from what people did over a couple of quarters instead of what they said they needed in a workshop, and unused entitlements collapse from most of the estate to a fraction of it.

Then split what's left. What the job genuinely needs becomes birthright. Everything else becomes just-in-time- requested when it's needed, granted for a window, expiring on its own. Standing privilege is the only reason a password reset is worth £29 million, and JIT is how you stop granting it by default.

Fewer groups isn't a cosmetic win. It's the difference between a review a human can perform and one they can only rubber-stamp.

Run those two continuously and the phone call still succeeds.

It just doesn't reach anything.

‍