Following the cyber incident involving ASOS, the online fashion and beauty retailers, insurance experts Everywhen are warning that compromised customer communications can create consequences extending far beyond IT systems.
Neil D’Mello, Client Director (South Division) at Everywhen, said: “A cyberattack can do more than steal information or shut down a company’s systems. It can potentially allow criminals to speak directly to customers through the very channels that they have been taught to trust. This highlights the growing importance of customer communications in cyber risk management, particularly after the incident involving online fashion retailer ASOS last month.”
On 6 October, ASOS customers received an unauthorised notification through the retailer’s app claiming that the company had been hacked. ASOS subsequently confirmed that it was investigating unauthorised activity involving third-party communication platforms.
On 8 October, the company said its initial investigation indicated that some customer names and contact details had been accessed, but that payment-card information and account passwords had not been affected. The retailer also confirmed that its website and app remained operational.
For Everywhen, the incident raises a wider question for businesses: what happens when customers can no longer be certain that messages appearing to come from a trusted organisation are genuine? Traditionally, conversations about cyber insurance have concentrated on data breaches, ransomware, system restoration and business interruption. However, the potential consequences of compromised customer communications introduce another dimension, involving reputational damage, customer confidence, fraud prevention and the costs associated with responding to an incident.
Neil D’Mello continues: “One of the most concerning aspects of a cyber incident is the possibility that criminals can exploit the relationship of trust between a business and its customers. Customers are accustomed to receiving notifications, emails and messages from organisations they deal with every day. If those channels are compromised, people may have difficulty distinguishing a genuine communication from a fraudulent one.
“Even when a business restores its systems quickly, rebuilding confidence can present a different challenge. The technical incident may be contained, but the questions from customers can continue.”
The incident demonstrates why cyber resilience should extend beyond protecting internal systems. Businesses increasingly depend on third-party providers to manage customer communications, payment services, marketing platforms and other essential functions.
Understanding who can access these systems, how that access is controlled and what happens if a communication channel is compromised, should form part of a wider cyber risk assessment.
The cyber threat landscape is being reshaped by AI but it is also emerging as an important part of security with AI itself helping to prevent cyberattacks, identify threats much earlier and accelerate the recovery process, after an incident. However, it is also being utilised by threat actors for malicious purposes.
Instead of focusing on AI potentially creating new threats, it is crucial to realise that it increases the speed, scale and sophistication of existing attacks. AI makes attacks more realistic, harder to identify, and lowers the barriers against threat actors.
The insurance implications deserve attention.
Cyber policies may provide access to specialist incident response, forensic investigation, legal advice, crisis communications and other support, subject to the policy terms. However, not every consequence of reputational damage or loss of customer confidence will necessarily be insured.
Neil D’Mello concludes: “Businesses need to consider not only how they would respond to a cyberattack, but how they would communicate with customers, if their normal communication channels can no longer be trusted.
“Who would issue the warning? How would customers verify it was genuine? And could the business respond quickly enough to limit the potential for further harm? These are questions that should be answered before an incident occurs, not during one.”