Following news that ASOS customer names and contact details may have been accessed in a cyber incident, Zain Javed, Director of Strategic Growth and Cyber Services at Citation Cyber, explains why shoppers could now face convincing follow-up scams and what the incident reveals about retailers’ reliance on third-party platforms.
Does this look like a direct breach of ASOS’s internal systems, or a vulnerability exposed through a third-party supply chain partner?
“At this stage, I would be very careful about calling this a direct breach of ASOS’s core systems.
“ASOS has said it is investigating unauthorised activity involving third-party platforms it uses to communicate with customers. That fits with one of the most striking aspects of this incident: the attackers appear to have been able to send a genuine push notification through a trusted ASOS channel.
“That doesn’t necessarily mean the third-party provider itself had a security vulnerability. It could be compromised credentials, an ASOS account within that platform, API access, a configuration issue or another route entirely. Snowflake has also said that, so far, it has found no compromise of its platform.
“What this does demonstrate is how much the modern attack surface has changed. A retailer might have strong security around its main website and internal network, but it will also be connected to marketing platforms, cloud providers, analytics tools, customer messaging systems and dozens of other services. Attackers only need to find one weak route into that ecosystem.”
If this involved stolen passwords from other sites, is it time for retail giants like ASOS to make two-factor authentication mandatory?
“For high-value customer accounts, I think we are reaching the point where relying on a password alone is increasingly difficult to justify.
“We already see that principle reflected in Cyber Essentials, the government’s baseline cyber security standard, where multi-factor authentication is required for cloud services where it is available. Passwords get reused, stolen and traded, and MFA provides another barrier when those credentials fall into the wrong hands.
“ASOS suffered a separate credential-stuffing incident earlier this year involving credentials obtained from sources outside ASOS. That demonstrates a wider problem for retailers – you can secure your own password database and still face account takeover because a customer has reused the same credentials somewhere else.
“For large digital retailers, I would expect the direction of travel to be towards MFA, passkeys and risk-based authentication, particularly where somebody logs in from a new device, changes account information or carries out other sensitive activity.
“It is important to separate that from the current incident, though. If this attack originated within a third-party communications platform, customer MFA would not necessarily have prevented it.”
Given the massive scale of their customer base, what level of GDPR fines and regulatory fallout could ASOS be facing?
“It is too early to predict a fine, and a cyber attack does not automatically mean an organisation has breached UK GDPR.
“The ICO (Information Commision’s Office) will want to understand what information was accessed, how many people were affected, whether appropriate technical and organisational controls were in place and, importantly in this case, how third-party and supply-chain risk was being managed.
“Under UK GDPR, the maximum penalty for the most serious infringements can reach £17.5 million or 4% of worldwide annual turnover, whichever is higher. But the regulatory landscape is also moving beyond data protection alone.
“The Cyber Security and Resilience Bill is designed to strengthen the UK’s cyber regulatory regime, including tougher enforcement powers and turnover-linked penalties for organisations that fall within its scope. It also places much greater emphasis on managed service providers and critical suppliers because government increasingly recognises that one weak point in a supply chain can create consequences far beyond that supplier itself.”
“That does not mean ASOS itself will necessarily fall within every part of that regime, but it shows the wider direction of travel. Cyber security and supply-chain resilience are increasingly becoming regulatory and board-level issues rather than simply IT concerns.”
Beyond simply changing passwords, what specific phishing or text message scams should ASOS shoppers be on high alert for over the next few days?
“The biggest risk now is that criminals capitalise on the publicity around the attack.
“Customers should be particularly suspicious of emails or text messages saying things such as ‘your ASOS account has been compromised’, ‘verify your account’, ‘reset your password’, ‘confirm your payment details’ or ‘claim compensation for the ASOS breach’.
“We could also see fake delivery notifications, refund messages or discount vouchers designed to look as though they have come from ASOS.
“This is particularly effective after a genuine cyber incident because the criminal doesn’t have to invent the story. Customers already know something has happened, so a message saying “we’re contacting you following yesterday’s security incident” immediately feels more believable.
“Anyone receiving a message like that should avoid the link and instead open the ASOS app or type the ASOS website address directly into their browser. ASOS itself advises customers that it will never ask for passwords or sensitive card information through social media and warns against unfamiliar links.”
If a digitally native giant like ASOS can be compromised, what is the immediate wake-up call for smaller e-commerce businesses?
“The biggest lesson for smaller businesses is that your cyber security is increasingly only as strong as the organisations you connect to.
“An online retailer might use separate suppliers for payments, CRM, email marketing, customer messaging, analytics, cloud hosting and fulfilment. Every one of those connections potentially expands the attack surface.
“The government is already pushing businesses in this direction through its Cyber Resilience Pledge. One of the three core commitments is for organisations to assess Cyber Essentials coverage across their supply chains and take a risk-based approach to requiring Cyber Essentials from suppliers.
“That is significant because it changes the conversation from “is our company secure?” to “can we demonstrate that the businesses we depend upon are secure as well?”
“For smaller e-commerce companies, the immediate actions should be relatively practical: make MFA mandatory for administrators, understand which suppliers hold or can access customer information, remove unnecessary privileged access, review API permissions and ask key suppliers how they demonstrate basic cyber assurance.
“Cyber Essentials is a sensible baseline for that conversation. It doesn’t guarantee an organisation cannot be breached, but it gives businesses a recognised minimum standard to build from.
“And with the Cyber Security and Resilience Bill moving towards stronger obligations around important suppliers and potentially significant turnover-based penalties for regulated organisations, supply-chain security is only going to receive more scrutiny.”
What is the absolute worst-case scenario for the average ASOS shopper’s personal data?
“It’s important to distinguish the worst-case scenario from what ASOS has actually confirmed.
“At the moment, ASOS says basic personal information including names and contact details may have been accessed, while it does not believe payment-card information or account passwords were affected.
“If the attackers ultimately obtained a broader customer dataset, the real danger would be the combination of information. An email address on its own has limited value. Add a person’s full name, phone number, home address, date of birth, shopping behaviour or other profile information and suddenly you can create an extremely convincing picture of that individual.
‘That information can then be used for highly targeted phishing, impersonation, attempts to take over other online accounts and, where enough identity information is available, potentially identity fraud.
‘For the average customer, that is why the secondary attacks can sometimes be more dangerous than the original breach. The initial compromise gets the data, but social engineering is often how criminals ultimately turn that information into money.”