Attackers gained initial access to Advanced, the NHS software supplier, by using stolen credentials that let them authenticate successfully on the first try. Once inside, they extracted live session tokens and moved laterally to encrypt systems that hospitals, GPs and ambulance services depend on. The initial credential phase would have been stopped by device-bound signatures, but the token phase faced no authentication barrier at all because the login had already succeeded.
Stolen Credentials Opened the First Door
Attackers reached Advanced through compromised credentials. According to Verizon's 2023 DBIR, stolen credentials have been the leading initial access method for five straight years. No public statement pins the exact vector to phishing or password reuse, yet the outcome matches the most common path: a valid login succeeded on the first attempt. The credential phase ended the moment the attacker authenticated with the stolen pair.
Tokens Removed Any Later Barrier
After the first login the attackers harvested live session tokens. Token theft happens after authentication is complete, so no second factor can intervene. The ransomware then operated with those tokens across connected NHS environments. No fresh login was demanded at each boundary.
The same pattern appeared in the 2022 Costa Rica Conti and Lapsus$ incidents: one valid set of credentials produced reusable tokens that reached multiple systems without further checks. Advanced's role as an MSP simply widened the blast radius once the tokens were in hand.
Incidents involving supply-chain or MSP compromise continue to show longer dwell times because the initial foothold already carries trusted access. In this case the second phase required no additional authentication at all.
Why the Damage Reached NHS Services
Advanced supplies software used by hospitals, GPs and ambulance services. Once the ransomware executed under stolen tokens, availability suffered across those downstream organisations. The company's disclosure and regulator statements confirm service outages but do not publish exact record counts or dwell time.
The credential phase could have been stopped by hardware-bound authentication. The token phase could not. Once the attacker held valid sessions the damage was already outside the scope of any login control.
The fix isn't complicated, but it requires ditching legacy MFA and passwords entirely. The full technical breakdown of what actually works is at mfa2point0.com.
FAQ
How did the attackers reach Advanced in the first place?
The Advanced NHS supplier attack started with stolen credentials that granted direct access. According to Verizon's 2023 DBIR, stolen credentials remain the top initial access method. Device-bound keys would have prevented the login because the private key never leaves the enrolled hardware.
Could any form of MFA have stopped the ransomware spread?
No. The second phase relied on live tokens obtained after the initial login. Token theft occurs after authentication finishes, so legacy MFA had nothing left to check. Only a fresh hardware signature on every request would have rendered the stolen tokens worthless.
Why did NHS services go down if Advanced was the target?
Advanced functions as an MSP whose platforms are embedded in NHS workflows. Once attackers controlled sessions inside Advanced, they could encrypt or disrupt those shared systems. The blast radius followed directly from the trusted position the stolen tokens provided.
What does the limited public detail actually tell us?
The BBC reporting and company statements confirm credential-based entry followed by ransomware that affected downstream NHS services. They do not disclose the precise phishing or password-reuse method. The two-phase verdict still holds: credentials were the entry point and tokens removed every later barrier.
Would passwordless authentication have changed the outcome?
It would have blocked the credential phase. Without a phishable password or OTP seed to steal, the attackers never obtain the first valid session. Any later attempt to move laterally would then require a fresh signature from hardware the attackers did not possess.
