Attackers reached Advanced, the NHS software supplier, by presenting stolen credentials that worked on the first attempt. They then extracted live session tokens and used them to encrypt systems relied on by hospitals, GPs and ambulance services. Service outages followed across multiple NHS organisations. The initial login succeeded because the credentials were already valid; the later movement required no further authentication at all.

How Stolen Credentials Granted Immediate Access

The attackers authenticated directly with credentials that had already been obtained. According to Verizon's 2023 DBIR, stolen credentials have been the leading initial-access method for five straight years. Any legacy second factor that travels over the network would have been supplied in the same request, because the password itself was known. Device-bound credentials close this path at the source because the private key never leaves the enrolled hardware and every signature is tied to the exact origin.

Why Session Tokens Removed Every Subsequent Check

Once the first login completed, the attackers harvested the resulting session tokens. Token theft occurs after authentication finishes, so no login factor can intervene. The ransomware operated under those tokens across connected NHS environments without needing fresh logins at each boundary. The same credential-then-token pattern appeared in the 2022 Costa Rica Conti and Lapsus$ incidents. Advanced's role as an MSP simply widened the blast radius once the tokens were in hand. This is why supply-chain incidents continue to show longer dwell times precisely because the initial foothold already carries trusted access.

Device-Bound Signatures Close the Initial Vector

Device-bound credentials stop the credential phase because an attacker who holds only a password or OTP seed cannot produce a valid signature. The login attempt fails before any session token is issued. Once tokens are already in memory, however, the damage has moved past the authentication boundary. MFA 2.0 cannot prevent in-memory extraction. Enterprise SSO amplifies the problem because a single valid session grants access to every federated service. Replacing that model with per-application explicit signatures ensures each request carries its own hardware-backed proof rather than inheriting a reusable token. The UX remains one-tap for the user, but no shared token exists to replay across systems.

It is important to note that FIDO2 and passkeys protect only the authentication exchange itself. If email links, SMS codes or helpdesk calls are still used to register devices or handle recovery, an attacker who controls that channel can enroll their own hardware. Public statements on the Advanced incident give no detail on enrollment flows, so it is impossible to determine whether this gap was exploited. Any deployment that leaves phishable factors in the enrollment path leaves the same opening.

The same playbook hit Costa Rica's government systems in 2022. The full technical breakdown of what actually works is at legacymfa.sucks.

FAQ

How did the attackers reach Advanced in the first place?

The Advanced NHS supplier attack began with stolen credentials that granted direct access on the first attempt. According to Verizon's 2023 DBIR, stolen credentials remain the top initial-access method. Device-bound keys would have prevented the login because the private key never leaves the enrolled hardware.

Could any form of MFA have stopped the ransomware spread?

No. The second phase relied on live tokens obtained after the initial login. Token theft occurs after authentication finishes, so no second factor had anything left to check. Only a fresh hardware signature on every request would have rendered the stolen tokens worthless.

Why did NHS services go down if Advanced was the target?

Advanced functions as an MSP whose platforms are embedded in NHS workflows. Once attackers controlled sessions inside Advanced, they could encrypt or disrupt those shared systems. The blast radius followed directly from the trusted position the stolen tokens provided.

What does the limited public detail actually tell us?

The BBC reporting and company statements confirm credential-based entry followed by ransomware that affected downstream NHS services. They do not disclose the precise phishing or password-reuse method. The two-phase verdict still holds: credentials were the entry point and tokens removed every later barrier.

Would passwordless MFA 2.0 have changed the outcome?

It would have blocked the credential phase. Without a phishable password or OTP seed to steal, the attackers never obtain the first valid session. Any later attempt to move laterally would then require a fresh signature from hardware the attackers did not possess.