In November 2025, an attacker attempted to gain access to one of our client’s systems by impersonating a legitimate employee and requesting a password reset.
It was a simple attack that didn’t use any advanced technology, malware, or hacking tools. The attacker picked up the phone and attempted to target people.
Fortunately, the attempt was stopped immediately because Sentrian's service desk followed one basic cybersecurity principle that every organisation should expect from its MSP: Verify identity before providing access.
The attack attempt
The attacker called Sentrian's service desk claiming to be an authorised user from one of our clients.
Their objective appeared to be to obtain a password reset and gain access to an account.
As part of Sentrian's standard password reset procedure, our engineers followed established identity verification processes before making any changes to the account. The caller was unable to meet those verification requirements.
The caller tried several times, speaking to different engineers in the hope of getting a different outcome. They didn't.
Every engineer followed the same process, and every request was denied.
The attack was unsuccessful.
Quick detection contained the attack before it ever started
The attempt was uncovered during the very first phone call.
Red flags were immediately raised when the caller couldn’t meet the identity verification requirements.
The request was escalated for further review.
The incident was then shared across the service desk team to prevent further attempts from succeeding, and the client was notified.
The entire incident was effectively detected and contained during the phone calls themselves.
What could have happened?
If the password had been reset without proper verification, the attacker could have gained access to a legitimate user account.
Depending on the privileges associated with that account, the consequences may have included:
- Access to sensitive business information
- Exposure of confidential client data
- Email compromise
- Further credential theft
- Financial fraud
- Impersonation of staff
- Lateral movement into other systems.
While it's impossible to know the attacker's ultimate objective, gaining access to a trusted account is often the first step in a much larger cyber incident.
Is your MSP following this protocol?
This incident highlights an important reality about modern cyber threats.
Most people picture cyber attacks as highly technical operations involving malware or sophisticated hacking tools.
In reality, many attacks start with something far simpler: a phone call, an email, or a convincing story designed to bypass normal procedures.
The protection that prevented this incident was a standard, documented process followed by our staff who followed it consistently.
It’s a standard protocol that all MSPs should follow.
What you can do to protect your business’s data
Every organisation, and their MSP, should ensure that:
- Password resets require identity verification
- All staff have clear security procedures to follow
- Security processes are applied consistently, regardless of who is calling
- Suspicious requests are escalated and shared across support teams
- Staff are regularly reminded why these controls matter.
Technology is critical, but people and process continue to be some of the most effective cybersecurity controls available.
Are your defences ready for a hack attempt?
This attack failed because a basic control was in place and followed correctly.
That's exactly how cybersecurity should work.
A determined attacker only needs one employee to bypass a process. Your service provider should be making sure that never happens.
Technology is only one part of the battle. The people responsible for protecting your business should have the processes, training, and discipline to contain attacks before they happen.
Protect your organisation with Sentrian Cybersecurity
Cyber threats don't always arrive through sophisticated attacks. Sometimes, they begin with simple attempts to exploit gaps in process, trust, or human behaviour.
Sentrian's cybersecurity services help organisations build multiple layers of protection across technology, people, and processes. From managed security and monitoring to user awareness, identity protection, and governance, we help businesses reduce risk without adding complexity.
With decades of experience supporting Australian organisations, our team focuses on practical security outcomes that keep your business protected, productive, and resilient.
Talk to Sentrian about strengthening your cybersecurity posture and reducing your exposure to modern threats.
