IAM Failures: Lessons From 2025’s Biggest Breaches
The year 2025 has witnessed a surge in cyberattacks against major brands, with weak Identity and Access Management (IAM) playing a significant role in security failures.
From Marks & Spencer’s supply chain breach to the Co-op’s ransomware attack and Harrods’ insider data leak, organisations are paying the price for outdated access controls.
This article explores:
- How recent 2025 breaches exploited IAM weaknesses.
- Common IAM vulnerabilities exposed.
- Best practices to strengthen security.
- Future trends shaping IAM .
2025’s Major Breaches: The IAM Connection
Recent High-Profile Attacks Linked to IAM Failures
| Attack (2025) | Impact | IAM Failure |
| Marks & Spencer | Supplier portal breach → customer data exposed | Shared vendor credentioal, no MFA |
| Co-op | Ransomware attack → Stores offline for days | Compromised admin account, weak MFA |
| Harrods | Employee payroll data leaked | Insider abuse of excessive access rights |
| Tesco Bank | Fraudulent transactions via credential stuffing | Weak customer password policies |
| British Airways | Loyalty programme hacked via third-party API | Inadequate partner access controls |
How Attackers Exploited IAM Gaps
- Marks & Spencer – Attackers breached a third-party vendor portal using default or reused credentials, then pivoted into internal systems.
- Co-op – Hackers phished an IT admin, bypassed SMS-based MFA, and deployed ransomware.
- Harrods – A disgruntled employee accessed and leaked salary data due to overly broad HR access permissions.
- Tesco Bank – Attackers used credential stuffing from earlier breaches; no system was in place to detect compromised passwords.
- British Airways – A compromised API key from a travel partner gave attackers access to loyalty accounts.
Key Takeaway: Most 2025 breaches were not the result of elite hacking - they stemmed from avoidable IAM oversights.
The Top 3 IAM Vulnerabilities Exploited in 2025
1. Third-Party & Supply Chain Weaknesses
- Marks & Spencer’s breach originated from a vendor’s weak credentials.
- British Airways suffered due to mismanaged API keys by a travel partner.
Fix:
- Enforce **phishing-resistant MFA** for third-party access.
- Isolate** and monitor vendor access using **Zero Trust Network Access (ZTNA)**.
2. Weak or Outdated MFA
- Co-op’s** breach succeeded due to phishable SMS-based MFA.
- Tesco Bank** lacked mandatory MFA for customer accounts.
Fix:
- Implement **phishing-resistant MFA** (e.g., **FIDO2 keys, biometrics**).
- Decommission **SMS MFA** for privileged accounts.
3. Excessive Permissions & Insider Threats
- Harrods** exposed the risk of over-permissioned employees.
- An NHS contractor breach (2025)** occurred due to access not being revoked post-termination.
Fix:
- Apply **least privilege access** (**RBAC or ABAC**).
- Conduct quarterly **access reviews** and automate user lifecycle management.
How to Prevent the Next Big IAM Breach
1.Treat Third-Party Vendors as High-Risk
- Review all vendor access to ensure **strong authentication**.
- Segment their access to **limit lateral movement**.
2. Eliminate Passwords Where Possible
- Adopt FIDO2 or biometric authentication used by Microsoft and Google.
- Block breached passwords by integrating tools like Have I Been Pwned.
3. Monitor and Automate Identity Threat Detection
- Deploy **Identity Threat Detection and Response (ITDR) tools.
- Use AI/ML to detect anomalies (e.g., an HR account downloading all payroll data at 3 AM).
4. Prepare for Post-Breach Scenarios
- Define and test rapid access revocation workflows (disable compromised accounts within **10 minutes).
- Conduct IAM-focused breach drills during incident response tests.
The Future of IAM: 2025 and Beyond
AI-Powered Identity Defence
- Behavioural analytics to detect **risky logins** before credential abuse.
Decentralised Identity (Self-Sovereign Identity)
- Blockchain-based** digital identities reduce single points of failure.
Continuous Authentication
- Real-time verification via behavioural biometrics (e.g., mouse movements, keystroke rhythm).
Regulation Driving IAM Evolution
- GDPR 2.0 (Expected 2026) may **require passwordless MFA** for all customer-facing services.
Conclusion: IAM is Your First - and Last Line of Defence
2025’s breaches have made one thing clear - Identity and Access Management is non-negotiable. From Co-op’s ransomware disaster to Harrods’ insider scandal, outdated IAM has been the common denominator.
Ask yourself:
- Are your employees, vendors, and customers truly protected?
- Can you detect and respond to access abuse in real time?
- Are you ready for a passwordless future?
The next major breach is already forming in someone’s inbox or API log -don’t let it be yours.
Sidra Mobeen is an IAM & Risk Strategist & EMCC Practitioner Coach
Image: Ideogram
You Might Also Read:
Understanding Identity & Access Management:
If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.
- Individual £5 per month or £50 per year. Sign Up
- Multi-User, Corporate & Library Accounts Available on Request
- Inquiries: Contact Cyber Security Intelligence
Cyber Security Intelligence: Captured Organised & Accessible
