ASOS Breach: When Attackers Use Your Voice to Message Customers

ASOS Breach: When Attackers Use Your Voice to Message Customers

•

Episode description

ASOS Breach: When Attackers Use Your Voice to Message Customers

When ASOS customers received a push notification announcing the company had been hacked, it came through ASOS’s own app. The attackers had gained access to third-party communication platforms via social engineering and used them to address customers directly. Whilst card details and passwords appear unaffected, names, contact information and search histories may have been compromised. The incident raises an uncomfortable question for every business with customer communication systems: if somebody steals one login, can they impersonate you to everyone on your list? Noel Bradford and Lucy Harper examine what small businesses can learn from this case, from limiting account permissions and implementing proper multi-factor authentication to rehearsing incident response when nobody knows who holds the off switch. The episode also addresses why ‘basic’ customer data isn’t harmless when stacked together, how to communicate during an ongoing investigation without promising certainty you don’t have, and the critical difference between changing a password and actually revoking access. Sponsored by GRCBolt, the episode closes with a preview of the Ahsay CBS backup console vulnerability being actively exploited since 7 October 2024.

GRCBolt is a done-for-you AI policy pack for UK small businesses. It is not open yet, but the waitlist is: https://grcbolt.co.uk

Chapters

  • Cold Open An ASOS customer receives a ransomware notification through the company’s own app, addressed to ‘ASOS DPO and IT’. The attackers have used ASOS’s platform to message customers directly, raising questions about trust and control.
  • Welcome Introduction to the episode and the central question: if somebody gets into the account that talks to your customers, who can actually stop them?
  • What We Actually Know Timeline and verified facts from the ASOS incident. Push notification sent 6 October claiming Snowflake compromise. ASOS confirms unauthorised third-party platform access via impersonation attack. Names, contact details and account information accessed, but not passwords or card details. Snowflake denies platform vulnerability.
  • They Borrowed Your Voice How compromised communication platforms undermine customer trust. When messages come from genuine accounts through familiar channels, traditional verification advice breaks down. The danger of inherited permissions and shared logins in marketing and booking systems.
  • The MFA Question Why ‘they should have had MFA’ oversimplifies the problem. Different types of multi-factor authentication offer different protections. The NCSC now recommends passkeys where supported. Emphasis on checking actual account configurations, not policy documents.
  • Basic Information Isn’t Harmless Why names and contact details become dangerous when combined with context like shopping behaviour and search history. How attackers use ‘basic’ data to craft convincing follow-up scams. The importance of telling customers how you will and won’t contact them.
  • GRCBolt Sponsor message for GRCBolt, a done-for-you policy service helping small businesses create tailored governance, risk and compliance documentation.
  • Friday Afternoon Incident response scenario: a customer reports receiving a suspicious message that looks legitimate. Who can stop more messages going out? The gap between IT support scope and marketing platform access. The need for pre-agreed emergency procedures and authority to act.
  • Are They Actually Out? Why changing a password isn’t enough. How active sessions, connected apps and secondary accounts can persist. Microsoft’s guidance on session revocation limitations. The importance of audit logs and knowing what to check after a compromise.
  • Can I Trust the Next Message? Communicating with customers during an ongoing investigation. How to provide updates without overpromising certainty. The need for a separate, secured channel customers can verify. Distinguishing between ‘no evidence found’ and ‘definitely didn’t happen’.
  • Tomorrow Morning Three practical steps: find it (identify systems and access routes), limit it (test containment procedures), rehearse it (run a fifteen-minute tabletop scenario). Focus on one customer-facing system at a time. Identify named owners, backup contacts and emergency procedures.
  • Closing and Ahsay Teaser Summary of key lessons and preview of next episode covering the Ahsay CBS backup console vulnerability actively exploited since 7 October 2024. Huntress reports web shells and cryptocurrency miners being deployed, with version 10.3.4 confirmed affected.

Links