Customer Support Was the Route Into Four Separate 2025 Incidents

Recruited support agents at an exchange, at 25-0514. A support portal into a school platform, at 25-0105. API tokens in support tickets, at 25-0826. An outsourced support provider at a consumer platform, at 25-1003b. Service desks across retail, insurance, aviation and universities, at 25-1022.

It must be able to reach customer data, because resolving problems requires seeing the account. It must be responsive to people it cannot identify by sight, because that is who calls. And it is measured on speed and satisfaction, not on refusal rates.

That is the same three-property structure this desk applied to security appliances at 25-0805 and to file transfer at 25-0903. In each case the properties are not defects — they are the function — and a vulnerability there is worth more than the same vulnerability elsewhere.

Support is outsourced to reduce cost. Security programmes are built around the systems everybody agrees are important — the observation at 25-1024 about university advancement offices, and at 25-0601 about insurance sales estates.

The reached system is almost never the one the security programme was built around, and support is the clearest annual example of it.

Not training, per 25-1022 — an agent who correctly refuses 999 calls and is deceived on the thousandth has not failed.

What helps is narrowing what a support session can reach, requiring a second channel for anything that changes authentication, and treating the support estate as production rather than as internal tooling — the classification error at 25-0105.

Each of those slows support down, which is the trade being made by default in favour of speed. Graded medium: this is a synthesis across incidents, and the corpus cannot say what proportion of all 2025 incidents entered this way.