Actor profile· ACT-001
Scattered Spider
ActiveFinancially motivatedHelp-desk social engineeringSector-sweeping
The operation that made the service desk the perimeter. English-speaking, telephone-first, and notable in this corpus for working one sector at a time — retail, then insurance, then aviation — rather than taking whatever it found.
22
Files naming the group
7
Sectors in the corpus
2
Jurisdictions
2023
Earliest file
Campaign timeline14 most recent of 22
JUL 2026UK retail sector26-0725Four arrested over attacks assessed in the hundreds of millions. Three were teenagers, and the technique was a phone call.JUL 2026Transport for London26-0716bTwenty-seven thousand employees queued in person to reset a password. That is what a broken identity system looks like.APR 2026Outsourced IT service desks26-0413The contract moves the work, the staffing and the cost. It does not move the consequence of resetting the wrong person’s credential.APR 2026Marks & Spencer and Co-op26-0411A phone call to an outsourced service desk, a password reset, and £270–440 million across two retailers assessed as one event.FEB 2026Harrods26-0204Three retailers, one crew, one window. The reusable asset is the shared supplier estate behind the brands.DEC 2025Scattered Spider cluster25-1205Removing seven participants from a population defined by willingness rather than skill leaves the population substantially intact.JUL 2025UK retail campaign25-0724An unsophisticated technique that works is not a lesser threat than a sophisticated one. It is a worse one.JUL 2025Multiple sectors25-0702By the final phase there was no peer sector to watch, because the target was defined by a product rather than an industry.JUN 2025Airline operational systems25-0628A safety regime, built for other purposes, produced the segmentation that a security argument has repeatedly failed to fund elsewhere.JUN 2025North American and Australian carriers25-0627An airline reading about Hawaiian on a Monday had, at most, a fortnight.JUN 2025Enterprise authentication estates25-0625An authentication estate is only as strong as its weakest enabled option — and disabling produces an outage with a name attached.JUN 2025US insurers25-0622A caller claiming to be an agent locked out before a client meeting is making a request the function exists to grant, dozens of times a day.JUN 2025Aflac25-0618The reporting duty tracks the sensitivity of the record. The security expectation tracks the sector of the company.JUN 2025Ahold Delhaize USA25-0615A notification arriving from an entity the recipient may not recognise as connected to the shop.
All 22 files naming Scattered Spider© 2026 ForensicPost Media · the desk · newsletter · attribution policyGlossary