A Stolen Laptop Plus a Help-Desk Call Is One Incident
The CMC said the 2025 UK retail incidents pointed at help desks. Add a missing device to that phone call and the case gets simpler for the attacker, not for you.
The Cyber Monitoring Centre's June 20, 2025 statement on M&S and the Co-op described initial access as social engineering, with reports of compromised credentials and abuse of IT help-desk processes. M&S, for its part, told customers on May 13 that account passwords were not among the data taken, and that people would be prompted to reset anyway.
Put those facts next to a stolen laptop. The attacker does not need the password that was not stolen if a help desk will mint a new one for anyone who sounds rushed and knows an employee ID. The laptop is the prop. The reset is the access.
One queue, two checks
- If a device is reported stolen, freeze resets for that user until a second channel confirms the person. A callback to a known number, not the number the caller just offered.
- Wipe the enrolled device before you discuss a replacement login.
- Log the request even when you refuse it. The CMC's story is a pattern, not a single phone call.
DriveStrike is the wipe in that sequence. The refusal script is yours to write. Background is in the June 2025 retail note and the offboarding note, which is the same freeze without the attacker.
Contact Spearstone to line the script up with a real wipe console, or try DriveStrike before you need the refusal to be fast.
Keep reading
- The Unmanaged Phone Is Where Corporate Passwords Keep Showing Up
- DRAM Prices Are Set to Jump. A Stolen Laptop Just Got More Expensive.
Questions worth answering directly
Did M&S say passwords were stolen?
No. The May 13, 2025 update said account passwords were not included, and that customers would still be prompted to reset as a precaution.
What did the CMC say about how the retail incidents started?
It said the initial access vector was believed to involve social engineering, with reports suggesting compromised credentials and potential abuse of IT help-desk processes.