E-Commerce Cybersecurity Solutions & Training

Over the Easter weekend in April 2025, attackers got into Marks & Spencer, one of the UK's largest retailers, without exploiting a software flaw. The company's chairman later told a UK parliamentary committee that the entry came through sophisticated impersonation involving a third party, and reports at the time described a third party being tricked into resetting an M&S employee's password. Ransomware followed.

M&S stopped taking orders through its UK and Ireland websites and apps for about six weeks. Customer data was taken, including names, contact details, dates of birth, and order histories. In May 2025 the company estimated the hit to its operating profit at around £300 million.

Password resets are the most routine request a service desk receives, and the people who handle them are measured on speed and helpfulness. An impersonator who sounds like a colleague locked out of their account is not asking for anything unusual; they are asking for the one thing the desk exists to provide. The request succeeded because it matched the job description exactly.

From the agent's side of the conversation, there was nothing to see. The caller knew the right names, the right systems, and the right amount of impatience, and the agent had no independent way to confirm who was on the line. Verification steps feel like friction when the person asking seems legitimate, and friction is precisely what a service culture is designed to remove. The attacker did not break the process. They used it as intended.

The people who can reset passwords, grant access, or change account details carry more risk than their job titles suggest. Odin weights each risk score by role criticality and privileges, so service desk agents, IT administrators, and storefront admins sit at the top of the risk view instead of disappearing into a company-wide average.

Those same people can be tested against impersonation. Blackbait builds scenarios from OSINT on the targets you select and tracks who is compromised, and Whitebait adds MFA-targeted and credential harvesting simulations for the same group. Codex training covers business email compromise and the authority and urgency cues an impersonator relies on, and every policy acknowledgement is recorded against the employee's profile.

Fraus's view of the human attack surface also includes third parties, which helps security teams see where outside access adds human risk. For retailers in the GCC, campaigns and training run in Arabic as well as English.