It implied to me that they got their end users using MFA etc but 'coz: reasons, third party suppliers were given a terminal server with user/pass access and no

It implied to me that they got their end users using MFA etc but 'coz: reasons, third party suppliers were given a terminal server with user/pass access and no MFA. At least some of those third parties may have had say Domain Admin access privs. One of those accounts was compromised in some way. They have no logs 'coz vandalism but I bet a shufti through their or their third party's password database(s) might be instructive. There is no real technical detail because the break in did not involve anything fancy. I had a customer who sadly no longer trade (unrelated to these events) who once created a temporary email account called mail with a password of mail so that the CEO could get up and running whilst on a trip to China (we are all Brits here!) What could possibly go wrong? It took two years for this account to be used to send a tiny deluge of spam emails for a few hours. I should point out that this email account was attached to a login account which was an admin because they had simply copied an existing account to use as a template and then added email to it. The template account was called admin. Oh how we laughed when I explained all this to them. On behalf of another customer, I ended up driving into deepest, darkest Wales with a NAS wrapped in a blanket in my car to a data restoration company. The NAS had crashed when the baddies tried to wipe it. They had "deleted" the data but not managed to overwrite it with rubbish. This break in was a terminal server for third parties to use and a compromised password ... That 18 pages speaks volumes to me.