It seems like every week another high-profile retailer or company is hit by a cyber breach. This week it was ASOS, and as we were writing this, golf retailer American Golf confirmed it had been hit too. The way the ASOS incident unfolded is a useful reminder for businesses of every size.
What happened at ASOS
On Tuesday 6 October, ASOS customers received an unauthorised app alert headed “ASOS HACKED” at around 10am. The sender claimed to have gained full access to an ASOS system hosted by Snowflake and told the company to make contact or face a data leak. The alert linked to a Telegram channel that named a group calling itself Xuanye. ASOS shares fell by more than 11 per cent in the hours that followed. Computing reported on the incident.
ASOS said the message was not authorised. In its statement to the London Stock Exchange, it said it was investigating unauthorised activity involving third-party platforms used to communicate with customers, and that it restricted access to those platforms straight away. The National Cyber Security Centre said it was in contact with ASOS and had offered support.Retail Gazette covered ASOS's statement.
What we know about the cause
On 8 October, ASOS gave more detail in an email to customers. It said an unauthorised party gained access to an employee account by impersonating a trusted contact to obtain login credentials, and then used those credentials to reach information on certain third-party platforms. The company said the exposed data included some customers’ names and contact details, along with certain non-personal account information. It said no payment card information or account passwords were involved. ASOS's customer update was reported by KSL.
The attacker's claim that the Snowflake platform was “fully compromised” has not been confirmed. As one industry expert pointed out, the claim has not been independently verified. ITV reported on what was and was not known.
And now American Golf
On Tuesday 13 October, American Golf notified its customers that it had suffered a data breach. The company said more information would follow, so the full scope of the incident was not yet clear. It adds to a run of retail incidents that has left customers wondering who will be next.
The lesson for businesses
The headline detail in the ASOS case is not a sophisticated technical exploit. By ASOS's own account, the way in was a person being convinced to hand over their login details. The attacker then used those credentials to reach third-party systems.
That matters because it shows how far a single compromised account can reach. Customer communications, cloud platforms and supplier tools are all part of your attack surface, not just your own network. It also pays to be sceptical in the aftermath of any incident like this. High-profile incidents create ideal conditions for phishing attacks, so customers of both retailers should treat unexpected messages about the breaches with caution.
A breach can also have consequences well beyond immediate technical recovery. Read our guide to the cost of a data breach for a small business for more on the operational and financial impact.
Where Cyber Essentials fits in
Cyber Essentials is the UK government-backed scheme that sets out five basic technical controls:
- Firewalls: protecting your network boundary.
- Secure configuration: removing unnecessary software and default settings.
- User access control: limiting who can access what, with multi-factor authentication where it is offered.
- Malware protection: stopping malicious software from running.
- Security update management: keeping devices and software patched.
No certification makes a business immune, and Cyber Essentials will not stop every social engineering attempt on its own. But strong access control, multi-factor authentication and a tidy, well-managed set of accounts and third-party services shrink the damage a stolen password can do. Those are the basics that make an attacker's job harder, and they are the ones that so often get missed. If you are unsure where to start, our guide to Cyber Essentials for small businesses explains what certification can and cannot do.
Talk to us
If you are not sure where your business stands, we can help. At Max Cybersecurity we guide organisations through Cyber Essentials certification and help you find and close the gaps before an attacker does.