Some thoughts here from Jonathan Lee, Director of Cyber Strategy and UK Public Policy Lead at TrendAI.
Jonathan has over two decades of experience advising UK organisations on how to prevent cyberattacks and works closely with the public sector on major cyber threats.
“While the attack first drew attention because of the way it was publicised, the bigger concern now is the scope of the information that appears to have been accessed. Reports that personal contact information, including addresses and phone numbers, alongside shopping search history, was compromised significantly increase the risk of targeted phishing, fraud and impersonation attempts. Information that may seem relatively harmless in isolation can become far more valuable to cyber criminals when combined to build a detailed picture of an individual.”
“The focus from ASOS should now be on strengthening the controls around access to platforms that hold customer information like Snowflake. That includes putting in place phishing-resistant multi-factor authentication, restricting access by device and location, reducing unnecessary privileges and monitoring for unusual behaviour. Large-scale data access, unusual user activity and access from unexpected locations should all stand out long before a customer sees a message such as this one. There is also a strong case for reducing the amount of data that is retained in such platforms. Organisations should regularly review what they store, how long they keep it and whether it’s needed. The less sensitive data available to an attacker, the lower the potential impact of a breach.
“From a customer perspective, the goal should be to make any stolen credentials far less useful to cyber criminals. Multi-factor authentication, passkeys, device-based trust and stronger protection against automated attacks can all help reduce account takeover of an individual, which may follow such a breach. Customers should be particularly cautious over the coming days as criminals know that people will be looking for information and may attempt to exploit that uncertainty with convincing emails, texts or social media messages claiming to be from ASOS.
The reported access to customer profile and search-history data could make those scams appear even more credible and personalised. If you’re asked to reset a password, confirm account details or claim a refund, go directly to the ASOS app or website rather than following a link”.
Be the first to comment