This is a common pattern, not a mandatory sequence. Some attacks achieve their goal in a single step.

An attacker does not necessarily need advanced technical skills. They might buy stolen passwords, use ready-made criminal software or persuade an employee to approve a fraudulent payment.

Phishing is one of the most common ways criminals gain an initial foothold. They pretend to be someone the victim trusts: a bank, supplier, employer, colleague or online service. The aim may be to steal login details, install malicious software or persuade someone to transfer money. The UK's National Cyber Security Centre (NCSC) explains these techniques in its phishing guidance.

Source: National Cyber Security Centre.

Imagine a small business regularly pays invoices from a plumbing supplier.

1. A criminal learns the supplier's name and identifies an employee who pays invoices.
2. The employee receives an email that looks like a genuine supplier message.
3. The email says the supplier has changed its bank account details.
4. The employee updates the details and pays the next invoice.
5. The money goes to an account controlled by the criminal, who may quickly move it elsewhere.

The criminal may never have hacked the business's computer. They have exploited trust and a weakness in the payment-checking process.

• Verify changes to bank details through a known, independently obtained telephone number.
• Require a second person to approve changes and large payments.
• Protect email accounts with multi-factor authentication.
• Investigate unusual email forwarding rules and unexpected sign-ins.

The NCSC has described campaigns by the Russian state-linked group Star Blizzard that targeted individuals with carefully tailored messages. Victims were directed to convincing imitation sign-in pages; credentials and session information could then be used to access email accounts and read correspondence. The group also used compromised accounts for further targeting.

Source: National Cyber Security Centre.

This illustrates an important distinction: mass phishing casts a wide net, while spear-phishing targets selected people or organisations. A targeted message may refer to a real meeting, project or colleague, making it much more convincing.

Ransomware is malicious software that prevents an organisation from accessing its files or systems, commonly by encrypting data. Modern criminal groups may also steal information first and threaten to publish it unless the victim pays.

Source: National Cyber Security Centre.

A criminal gains access to an employee's account. Over time, the attacker reaches shared folders and other systems, then launches ransomware.

The business discovers that:

• Staff cannot access customer records or shared files.
• Booking, invoicing or production systems have stopped working.
• A ransom note demands payment.
• The attackers claim they have copied confidential data and will publish it.

The visible ransom note may be the first sign the business sees, even though the attacker may have been inside the network for days or weeks.

A UK government study published case studies of ransomware victims. In one, a medium-sized company had previously received recommendations about server patching and backup weaknesses, but these were not properly addressed. Attackers had gained access before the incident became apparent, explored files and remained dormant before striking. Personal information was subsequently found on the dark web.

Source: gov.uk

The lesson is that ransomware is often the final stage of a longer compromise, rather than the initial point of entry.

• Apply security updates promptly.
• Use multi-factor authentication and restrict administrator privileges.
• Keep backups that attackers cannot readily alter or delete.
• Test restoration procedures rather than merely assuming backups work.
• Monitor for suspicious access and large-scale file changes.

If a real ransomware attack occurs, isolate affected devices from networks, involve qualified incident responders and verify that backups are clean before restoring. The NCSC advises against assuming that paying a ransom guarantees recovery or deletion of stolen data. NCSC ransomware response guidance

Source: National Cyber Security Centre

Sometimes criminals do not need to break through a technical barrier. They use a legitimate username and password that has already been stolen, guessed or obtained through deception.

Change Healthcare processes medical claims and payments for healthcare providers. In February 2024, the company suffered a major ransomware attack attributed to the ALPHV/BlackCat criminal group.

United Health's chief executive told US lawmakers that the attackers used stolen login credentials to access a remote-access portal that did not have multi-factor authentication enabled. The incident caused widespread disruption to healthcare payments and services.
Reuters

The significance is that a stolen password can become a route into a major organisation if access controls are inadequate.

A password alone is not proof that the person logging in is the genuine account holder.

• Multi-factor authentication, preferably phishing-resistant methods such as security keys or passkeys.
• Removing unused accounts and promptly disabling accounts when staff leave.
• Restricting which systems each account can access.
• Alerting on unusual sign-ins, especially from unexpected locations or devices.

A website is software running on a server. Like any software, it can contain mistakes that expose information or allow unauthorised actions.

For example, a poorly protected application might allow a visitor to access another customer's booking, or an insecure administrative page might expose functions intended only for authorised staff.

A vulnerability becomes especially dangerous when an attacker can exploit it remotely without needing a legitimate account.

Suppose a booking system contains customer names, contact details and appointment records.

An attacker discovers that the application checks whether a user is logged in but fails to check whether that user is authorised to access a particular booking.

They may be able to change a booking identifier in a web request and retrieve another customer's information.

This is an example of a broken access-control weakness. The attacker may not need sophisticated malware at all.

• Check authorisation on the server for every sensitive operation.
• Use prepared SQL statements to prevent SQL injection.
• Keep PHP, libraries, frameworks and server software updated.
• Avoid exposing database credentials or error details.
• Log sensitive administrative actions and monitor unexpected data access.
• Test that one customer cannot view or alter another customer's records.

For a website, a successful login check and a successful authorisation check are different things. The first asks, 'Who are you?' The second asks, 'Are you allowed to do this?'

A recent example shows how an attack on one organisation can involve a third-party service.

On 8 October 2026, British online retailer ASOS disclosed a cyber security incident in which an attacker reportedly impersonated a trusted contact to obtain an employee's login credentials. Those credentials were then used to access certain third-party platforms used by ASOS. The company said names, contact details and search histories were among the information accessed, while payment card data and account passwords were not affected. The investigation was ongoing at the time of reporting.

Source: Reuters

This case illustrates three important points:

1. Trust can be exploited. An attacker may impersonate a known person rather than attack the technology directly.
2. Third-party access matters. A supplier or external platform can become a route to an organisation's information.
3. A breach does not necessarily mean the whole website has been taken over. Different systems hold different data and have different access permissions.

The appropriate response includes securing compromised accounts, reviewing third-party access, investigating what data was accessed and warning affected customers about possible follow-up scams.

When an organisation discovers an attack, cyber security investigators try to reconstruct the events using digital evidence.

Login and audit logs These can show which account accessed a system, when it happened, what was accessed and whether the sign-in was unusual.

Emails and messages Investigators examine suspicious messages, sender details, links and attachments to identify impersonation or malicious content.

Computer and server evidence Files, running processes, system logs and network records may reveal how access was gained and what the attacker did next.

Timeline reconstruction Investigators correlate evidence from different systems to establish the likely sequence of events, what was affected and whether information was stolen.

One important limitation: logs can be incomplete, deleted or misleading. Investigators distinguish what the evidence establishes from what they merely suspect. They also preserve evidence so that it can support disciplinary action or criminal proceedings where appropriate.

The same technical methods can be used for very different purposes.

These categories can overlap. A state-linked group may steal information, while a financially motivated criminal may use espionage-like techniques to investigate a target.

The NCSC's 2024 Annual Review
discusses threats to UK institutions and critical national infrastructure, including state-linked activity and ransomware.
National Cyber Security Centre