Latest / Tech Talks With Kinsoft / ASOS - One Phished Login, a Hijacked Push Notification, and the Marketing Tools Nobody Was Watching

Transcript

ASOS - One Phished Login, a Hijacked Push Notification, and the Marketing Tools Nobody Was Watching · Tech Talks With Kinsoft

• 0:00
  So imagine this. It is Tuesday, October 6th,
• 0:03
  2026. Okay. And millions of shoppers are just
• 0:06
  going about their day. They look down at their
• 0:09
  phones and they see a push notification from
• 0:11
  their absolute favorite clothing brand. Right,
• 0:13
  which happens all the time. Exactly. But it wasn't
• 0:16
  a 20 % off coupon. It was a hacker literally
• 0:19
  using the company's own app to announce to the
• 0:22
  world that they had broken in. It's just it completely
• 0:25
  shatters that baseline assumption we all walk
• 0:28
  around with, you know. Yeah, totally. That the
• 0:29
  apps living in our pockets, the ones we willingly
• 0:32
  give all our data to, are these secure walled
• 0:35
  gardens. Right. When a notification like that
• 0:38
  pops up, the garden walls haven't just fallen.
• 0:40
  The attackers are basically standing in the courtyard
• 0:42
  using the PA system. Okay, so let's unpack this.
• 0:46
  Welcome to today's deep dive, where we are pulling
• 0:48
  apart the massive cybersecurity incident that
• 0:51
  hit the British online fashion retailer, ASOS.
• 0:54
  Yeah, this is a fascinating one. It really is.
• 0:56
  And we're sourcing our insights today from a
• 0:58
  really in -depth analysis by Tech Talks with
• 1:01
  Kinsoft. This was published on Friday, October
• 1:03
  16th, 2026. Right. And our mission here isn't
• 1:06
  just to... recap the sensational headlines that
• 1:09
  dominated the news cycle for a week. Because
• 1:11
  there were a lot of them. So many. But we really
• 1:14
  want to uncover the surprisingly low -tech reality
• 1:16
  of how modern cyber breaches actually work. Yeah,
• 1:20
  that's the most important part of this whole
• 1:22
  story. Exactly. We're going to explore how a
• 1:24
  single conversation brought down a retail giant's
• 1:27
  communications, why marketing tools are the new
• 1:30
  prime target for threat actors, and what this
• 1:33
  fundamental shift means for your own digital
• 1:35
  safety. To really grasp the mechanics of what
• 1:37
  happened here, I mean, we need to understand
• 1:40
  the structural fragility of the target at that
• 1:42
  specific moment in time. Yeah, set the stage
• 1:45
  for us. So ASOS isn't just some boutique clothing
• 1:48
  shop. They are a London -listed fashion powerhouse.
• 1:51
  They were founded in 2000, and they manage about
• 1:54
  16 .4 million active customers. Wow, that is
• 1:57
  massive. Across more than 100 markets, yeah.
• 2:00
  And they have a particularly huge demographic
• 2:03
  of younger shoppers, notably in places like Australia.
• 2:06
  Right. Definitely a Gen Z and millennial staple.
• 2:08
  But the critical context here is their financial
• 2:11
  reality at the time. In October 2026, ASOS was
• 2:15
  actively navigating a highly scrutinized business
• 2:18
  turnaround. Oh, man. Yeah. They were trying to
• 2:20
  claw their way back to sustainable profit after
• 2:23
  a really rough few years. Meaning they were incredibly
• 2:25
  vulnerable to any disruption that might shake
• 2:27
  investor confidence. Exactly. I mean, a crisis
• 2:30
  like this hitting during a turnaround phase is
• 2:32
  basically the ultimate corporate nightmare. It
• 2:34
  really is. And at 10 a .m. UK time on that Tuesday,
• 2:38
  that nightmare went live. App users received
• 2:40
  a push notification titled simply, ASOS hacked.
• 2:44
  The wording of the message itself, I mean, it
• 2:46
  reveals a lot about modern extortion tactics.
• 2:49
  What did it actually say? The text read, in part,
• 2:52
  Dear ASOS, DPO, and IT, we have fully compromised
• 2:56
  the Snowflake instance. Engage with us or we
• 3:00
  will leak it. That is just so direct. And they
• 3:03
  included a link to a Telegram channel created
• 3:06
  by a group calling itself Zuanye Group. OK, wait.
• 3:09
  For people listening who might not be in enterprise
• 3:12
  IT, what is a DPO? Right. So the DPO is the data
• 3:16
  protection officer. They're the person legally
• 3:18
  responsible for ensuring the company handles
• 3:21
  consumer data according to the law. Calling out
• 3:24
  the data protection officer by name in a public
• 3:26
  push notification to millions of teenagers and
• 3:29
  young adults is just... A wild escalation. It's
• 3:33
  unheard of. It's like a burglar breaking into
• 3:35
  your house, not to quietly steal your television
• 3:38
  in the dead of night, but to hijack your home's
• 3:40
  intercom system just to announce to the entire
• 3:42
  neighborhood that your front door was unlocked.
• 3:44
  That's a great way to put it. The psychological
• 3:46
  panic isn't a byproduct of the hack. Right. The
• 3:49
  panic is the weapon itself. And that structural
• 3:52
  shift in how cybercrime operates is vital to
• 3:55
  understand. Because it used to be different,
• 3:57
  right? Totally. Historically, a ransomware group
• 4:01
  would breach a network, encrypt the servers,
• 4:03
  and then quietly email the executives to demand
• 4:06
  payment in exchange for the decryption key. Like
• 4:09
  a hostage negotiation behind closed doors. Exactly.
• 4:12
  It was a secret negotiation. But here, the attackers
• 4:16
  bypassed that entirely. They didn't even bother
• 4:18
  locking up the servers. Wait, really? Yeah. They
• 4:22
  weaponized public perception to apply maximum
• 4:25
  blinding pressure from minute one. They used
• 4:28
  the company's own infrastructure to corner the
• 4:31
  executive board in front of a global audience.
• 4:33
  And because ASOS was forced onto the defensive
• 4:36
  publicly and instantly, they couldn't control
• 4:38
  the narrative. Not at all. I mean, the market
• 4:40
  reacted before the IT department even knew what
• 4:43
  servers were supposedly compromised. And the
• 4:46
  financial impact was immediate. ASOS shares tanked
• 4:49
  up to 13 % during intraday trading. Ouch. Yeah,
• 4:53
  eventually closing down about 10%. The company
• 4:56
  had to rush a cyber incident update to the London
• 4:58
  Stock Exchange that exact same afternoon. But
• 5:01
  when you're actively under attack, I mean, you're
• 5:03
  flying blind, right? You are. Their filing was
• 5:06
  essentially a triage statement. What could they
• 5:08
  even say at that point? They confirmed they'd
• 5:11
  restricted access to their notification platforms,
• 5:13
  that they were working with specialist advisors,
• 5:15
  and that basic personal info like names and contact
• 5:19
  details might have been accessed. Okay. Pretty
• 5:21
  standard damage control. But they also noted
• 5:24
  they held cyber insurance. And the nimbidity
• 5:26
  was, quote, too early to quantify the trading
• 5:29
  impact. That phrase, too early to quantify, has
• 5:34
  to be the absolute most terrifying thing an investor
• 5:36
  can read. Oh, definitely. And because ASOS couldn't
• 5:39
  provide definitive answers yet, the regulators
• 5:42
  basically had to step into the vacuum. They had
• 5:44
  no choice. The UK's National Cybersecurity Center,
• 5:47
  the NCSC, issued an alert that same day with
• 5:51
  advice that felt, honestly, unusually blunt.
• 5:54
  Very blunt. They basically told the public, if
• 5:56
  you are an ASOS customer, assume you are affected,
• 5:59
  even if you didn't get the notification. And
• 6:01
  the Information Commission stepped in on Wednesday
• 6:03
  the 7th as well. Right. Their chief executive,
• 6:06
  Paul Arnold, issued a statement formally acknowledging
• 6:09
  how unsettling it is for customers to receive
• 6:11
  threats directly through an app they trust. Which
• 6:14
  makes sense. People were freaking out. It's worth
• 6:17
  a quick side note that this regulatory body was
• 6:19
  formerly known as the Information Commissioner's
• 6:22
  Office, the ICO, until late September of that
• 6:24
  year. Oh, right. The rebrand. Yeah. But the sheer
• 6:27
  volume of regulatory and government bodies responding
• 6:29
  within 24 hours shows how seriously this public
• 6:33
  -facing tactic shakes the establishment. Now,
• 6:36
  here's where it gets really interesting to me.
• 6:37
  In that initial push notification, the hackers
• 6:40
  explicitly pointed the finger at Snowflake. They
• 6:43
  name -dropped them right out of the gate. Right.
• 6:46
  And for context, for you listening, Snowflake
• 6:48
  is a massive cloud data platform. It's used by
• 6:51
  countless Fortune 500 companies to store and
• 6:53
  analyze data. It's a huge pillar of enterprise
• 6:56
  tech. So the hackers claim they compromised the
• 6:58
  ASOS Snowflake instance. But Snowflake immediately
• 7:02
  released a highly aggressive statement, completely
• 7:05
  denying any involvement. They did not hold back.
• 7:08
  They said there was no compromise on their end,
• 7:10
  no vulnerability, no misconfiguration, and that
• 7:13
  their customers didn't need to take any remediation
• 7:15
  steps. What's fascinating here is how effectively
• 7:18
  threat actors can manipulate the media cycle
• 7:20
  just by dropping a recognizable corporate name.
• 7:23
  Because it forces a response. Exactly. When Snowflake
• 7:26
  issued that emphatic denial, it created a standoff.
• 7:30
  The public is watching a major tech vendor say
• 7:32
  it wasn't us, while the hackers are publicly
• 7:35
  claiming to hold the keys to the kingdom. So
• 7:37
  who do you believe? Well, by Wednesday evening,
• 7:40
  the attackers realized their narrative was stalling.
• 7:42
  So they forced the media's hand. What did they
• 7:45
  do? They sent a sample of the stolen data directly
• 7:47
  to the BBC to prove they weren't bluffing. Wow.
• 7:51
  That entirely shifts the power dynamic. Completely.
• 7:54
  The media is now validating the hackers' claims
• 7:56
  because they possess the actual data sample.
• 7:59
  Right. I mean, for two days, there was this intense
• 8:02
  fog of war. Everyone from shareholders to cybersecurity
• 8:05
  analysts assumed some highly sophisticated digital
• 8:08
  vault had been blown open using cutting -edge
• 8:11
  code. That was the general assumption, yeah.
• 8:13
  But then Thursday rolls around. ASOS finally
• 8:16
  emails its customers with a full explanation.
• 8:18
  And the reality of the breach is, like, almost
• 8:22
  entirely devoid of technology. The Thursday update
• 8:25
  changed the entire conversation. ASOS revealed
• 8:28
  there was no software vulnerability. Zero. There
• 8:32
  was no zero -day exploit. There was no CVE, meaning
• 8:35
  the hackers didn't exploit some highly technical
• 8:38
  glitch in the code that the engineering team
• 8:40
  forgot to patch. So how did they get in? The
• 8:44
  breach occurred because an unauthorized party
• 8:46
  impersonated a trusted contact to trick an ASOS
• 8:50
  employee into handing over their login credentials.
• 8:53
  Okay, so... What does this all mean? We have
• 8:55
  this persistent cultural image of a hacker as
• 8:58
  a hooded figure typing thousands of lines of
• 9:00
  code in a basement debris to firewall. Like in
• 9:03
  the movies. Yeah, exactly. But you're telling
• 9:05
  me a multi -million dollar corporate security
• 9:07
  apparatus was bypassed because someone basically
• 9:10
  asked politely for the password on a fake Teams
• 9:13
  chat or a bogus text message? The technical sophistication
• 9:16
  was essentially zero. But the human manipulation
• 9:19
  was 100%. That is just wild. But this is the
• 9:23
  reality of the modern breach. We saw the exact
• 9:26
  same social engineering strategies hit Marks
• 9:28
  & Spencer and the co -op in the UK the previous
• 9:31
  year. So it's a trend. Oh, a massive one. An
• 9:34
  attacker will scrape LinkedIn to figure out who
• 9:36
  works in a company's IT department. Right. They
• 9:39
  will message a target employee, perhaps spoofing
• 9:41
  the CEO's number, creating a massive sense of
• 9:44
  urgency. Oh, I see. Something like, I'm locked
• 9:47
  out of the presentation platform and the board
• 9:49
  meeting starts in five minutes. I need you to
• 9:51
  bypass the security prompt. That's so manipulative.
• 9:54
  It is. The attacker relies entirely on human
• 9:56
  empathy and corporate deference to bypass the
• 9:58
  firewall. Wait, if the vulnerability is just
• 10:01
  human nature, like people wanting to be helpful
• 10:03
  to a colleague in a panic, no amount of firewall
• 10:06
  software is going to fix that. You're exactly
• 10:08
  right. Are IT departments basically fighting
• 10:11
  human psychology now? Pretty much, yeah. Because
• 10:14
  of standard two -factor authentication, you know,
• 10:16
  where you get a text message with a six -digit
• 10:18
  code, can just be talked away by a smooth scammer?
• 10:22
  What is the actual defense here? You have to
• 10:24
  implement systems where human psychology is removed
• 10:26
  from the authentication equation entirely. How
• 10:29
  do you do that? Well, standard SMS codes or app
• 10:33
  prompts are highly vulnerable to something called
• 10:36
  MFA fatigue. MFA fatigue? Yeah. It's where an
• 10:40
  attacker just spams the employee with login requests
• 10:43
  until they hit approve just to make their phone
• 10:45
  stop buzzing. Oh, I've had my phone blow up with
• 10:48
  prompts before. I totally get that instinct.
• 10:51
  Exactly. So the defense is phishing -resistant
• 10:54
  multi -factor authentication, specifically pass
• 10:58
  keys or hardware security keys. Okay, let's break
• 11:01
  down the mechanics of a pass key for a second.
• 11:03
  Sure. Why is it inherently better than typing
• 11:06
  in a six -digit code from a text message? So
• 11:09
  a pass key isn't a password you memorize or a
• 11:11
  code you type. It relies on a cryptographic handshake
• 11:15
  between your physical device, like your smartphone.
• 11:18
  or a USB security key, and the server you are
• 11:21
  trying to access. Okay. The key factor is that
• 11:23
  the cryptography is tied to the specific legitimate
• 11:27
  domain name. I see. So even if an employee is
• 11:31
  tricked into going to a perfectly faked login
• 11:33
  page, and even if they want to hand over their
• 11:36
  access, the hardware key recognizes that the
• 11:39
  fake website doesn't match the real cryptographic
• 11:41
  signature. Oh, wow. Yeah. The handshake fails.
• 11:45
  The attacker gets nothing. Because they don't
• 11:48
  physically hold the employee's laptop in their
• 11:50
  hands. That's incredibly smart. It is. And alongside
• 11:54
  that, companies need rigorous help desk identity
• 11:56
  verification. IT staff must be trained to verify
• 12:00
  identity thoroughly, perhaps through a secondary
• 12:02
  manager or video call, before resetting any credentials.
• 12:06
  Even if the person on the phone is screaming
• 12:08
  at them. No matter how angry the person on the
• 12:10
  other end of the line sounds. Exactly. OK, so
• 12:13
  the attacker talks an employee into giving up
• 12:16
  a credential. Right. But if they didn't breach
• 12:18
  the core financial systems or the engineering
• 12:20
  servers, what did that one stolen login actually
• 12:23
  unlock to allow them to send a push notification
• 12:26
  to millions of people? Well, the compromised
• 12:29
  account had access to ASOS's third party marketing
• 12:32
  and customer communication platforms. Oh, OK.
• 12:36
  If we connect this to the bigger picture. This
• 12:39
  incident proves that a company's marketing stack
• 12:41
  is its new attack surface. That makes total sense.
• 12:45
  Historically, businesses spend their entire security
• 12:48
  budget protecting the finance systems or the
• 12:50
  primary customer databases. But marketing tools
• 12:53
  are literally designed to broadcast messages
• 12:55
  to your entire user base. Companies lock down
• 12:59
  their financial data like a bank vault, but they
• 13:01
  leave their marketing databases open like the
• 13:03
  building's air conditioning vents. That's a really
• 13:05
  good analogy. And once a hacker is in the vents,
• 13:07
  they have access to every room. Those platforms
• 13:10
  hold massive copies of the customer list because
• 13:13
  they need that data to send personalized emails.
• 13:15
  And that brings us to the data that was actually
• 13:17
  exposed here. What did they get? ASOS stated
• 13:20
  that only names, contact details, and, quote,
• 13:23
  certain non -personal account -related information
• 13:26
  were taken. They were very clear that payment
• 13:28
  cards and account passwords were not affected.
• 13:31
  Which is a relief on the surface. On the surface,
• 13:33
  yes. But the BBC report on the data sample that
• 13:36
  the hackers leaked painted a much more invasive
• 13:39
  picture. It really did. The BBC noted the sample
• 13:42
  included names, addresses, phone numbers, dates
• 13:45
  of birth, and remarkably, customers' on -site
• 13:49
  search terms. It documented exactly what individuals
• 13:53
  had been typing into the ASOS search bar. And
• 13:55
  that specific detail changes the entire threat
• 13:58
  model of this breach. Absolutely. Stolen credit
• 14:00
  cards are a temporary financial headache. You
• 14:02
  know, they can be frozen and replaced in five
• 14:03
  minutes. But search terms are behavioral profiles.
• 14:07
  Think about the psychology of a search bar. Right.
• 14:10
  It's not just who you are. It's what you desire
• 14:13
  or what you are privately struggling with. Exactly.
• 14:16
  You might be searching for maternity clothes
• 14:18
  before you've told your family you're pregnant.
• 14:20
  You might be searching for specific plus size
• 14:23
  fits or medical adjacent garments. It's incredibly
• 14:27
  intimate data. Permanent data. We spend so much
• 14:31
  energy worrying about our bank details, yet we
• 14:33
  leave our behavioral vulnerabilities sitting
• 14:35
  in third -party marketing tools designed just
• 14:38
  to send us promotional newsletters. It's an immense
• 14:40
  privacy violation. And the scary part is there
• 14:44
  are still major unknowns hovering over this incident.
• 14:46
  Like what? Well, we don't know the exact scale.
• 14:49
  ASOS hasn't confirmed the number of affected
• 14:51
  users, though the attackers claim to the BBC
• 14:54
  they possess millions of profiles. Millions?
• 14:56
  Yeah. Wow. Yeah. We don't know if the compromised
• 14:59
  employee actually had multi -factor authentication
• 15:02
  enabled when they were targeted. Right. That's
• 15:04
  still unconfirmed. The attackers also claimed
• 15:07
  the specific third -party platform they breached
• 15:09
  was a personalization service called Simon AI,
• 15:12
  but that company hasn't commented. So it remains
• 15:15
  an unverified claim. Exactly. Furthermore, it's
• 15:18
  entirely unclear if the Chinese -sounding Shuanyi
• 15:21
  Group is a legitimate threat actor or just a
• 15:24
  false flag designed to misdirect investigators.
• 15:27
  Oh, to throw people off the scent. Precisely.
• 15:29
  And finally, we have no idea if their two -week
• 15:33
  ransom deadline carried any actual weight. So
• 15:36
  we just have a master class in chaos? Pretty
• 15:38
  much. How do we extract actionable intelligence
• 15:40
  from this? What are the hard lessons for the
• 15:43
  businesses running these sprawling marketing
• 15:45
  platforms? The first lesson is about timeline
• 15:48
  control. Okay. ASOS allowed the attackers to
• 15:51
  dominate the narrative for five hours before
• 15:53
  issuing their full statement to customers. That
• 15:55
  is a lifetime in a PR crisis. It is. During that
• 15:59
  massive window, customers only had the hacker's
• 16:01
  version of events. Kevin Beaumont, a prominent
• 16:04
  security researcher, openly criticized this approach.
• 16:07
  What did he say? He pointed out that ASOS suffered
• 16:10
  the exact same PR missteps as co -op and M &S
• 16:13
  by failing to be immediately transparent with
• 16:16
  their user base. But practically speaking, for
• 16:18
  the IT folks, how does a massive corporation
• 16:20
  prevent... A rogue employee login from having
• 16:23
  the keys to the entire customer base. Through
• 16:26
  aggressive access management, specifically single
• 16:29
  sign -on or SSO. SSO, right. Without SSO, a company
• 16:33
  might have hundreds of separate unmonitored logins
• 16:36
  for various marketing tools. When an employee
• 16:39
  quits, IT might forget to delete their specific
• 16:41
  account for a third -party email service, leaving
• 16:44
  an orphaned login active for years. Yikes. SSO
• 16:47
  centralizes authentication. Every tool checks
• 16:50
  back with one central identity provider. If an
• 16:53
  employee's central access is revoked, their access
• 16:56
  to every single marketing platform vanishes instantly.
• 16:59
  That is crucial. It is. And businesses must also
• 17:03
  draft public breach statements before an incident
• 17:06
  ever occurs. Regulatory frameworks don't pause
• 17:09
  for your PR team to get comfortable. No, they
• 17:11
  don't. Australian -listed companies, for example,
• 17:13
  have continuous disclosure obligations and operate
• 17:16
  under the Notifiable Data Breaches Scheme. you
• 17:19
  have to communicate immediately. Which brings
• 17:21
  us directly to you, the listener. While the executives
• 17:24
  are dealing with continuous disclosure laws and
• 17:26
  stock prices, you are the one dealing with the
• 17:29
  fallout of that exposed data. Exactly. Scammers
• 17:32
  aren't just going to send you a generic click
• 17:34
  here to reset your password email anymore. They
• 17:37
  are going to use those leaked search terms against
• 17:39
  you. That is the most immediate danger. An attacker
• 17:43
  will take your date of birth, your phone number,
• 17:46
  and the specific search query for that exact
• 17:48
  brand of winter coat you were looking at on October
• 17:50
  4th. So creepy. They will craft an SMS message
• 17:54
  that says, Your recent ASOS inquiry regarding
• 17:56
  the black winter coat requires a shipping update.
• 17:59
  Please confirm your payment details here. And
• 18:02
  because the context is hyper -specific to your
• 18:04
  actual behavior, the human brain just interprets
• 18:07
  it as legitimate. That level of personalization
• 18:10
  bypasses our internal spam filters completely.
• 18:13
  If a scammer knows what you were daydreaming
• 18:14
  about buying last week, their trap is going to
• 18:16
  look flawless. It really is. So moving forward,
• 18:19
  you have to assume you are affected by these
• 18:22
  breaches. Remember the golden rule. Legitimate
• 18:24
  brands will never ask you to confirm payment
• 18:26
  details, passwords, or personal information via
• 18:29
  an unsolicited text message or direct link. Never.
• 18:31
  If you receive a highly specific prompt, just
• 18:34
  close it, open your browser, and navigate directly
• 18:36
  to the official website yourself. That is the
• 18:38
  best advice. To summarize what we've unpacked
• 18:41
  today. The architecture of a modern cyber breach
• 18:43
  has fundamentally shifted. Yeah, it really has.
• 18:46
  It is primarily about exploiting identity and
• 18:49
  access rather than deploying complex malware.
• 18:53
  In the ASOS incident, the technical barrier to
• 18:56
  entry was almost non -existent. Right. The success
• 18:59
  of the operation relied entirely on human manipulation
• 19:02
  and the exploitation of trusted communication
• 19:04
  channels. It's a stark reminder that as our technical
• 19:08
  firewalls get stronger, attackers simply pivot
• 19:10
  to the weakest link in the chain, which is usually
• 19:12
  a well -meaning person sitting at a desk just
• 19:15
  trying to solve a problem for what they think
• 19:17
  is a coworker. Exactly. And this raises an important
• 19:20
  question, one that extends far beyond a single
• 19:22
  retail hack. What's that? Well, if threat actors
• 19:26
  are shifting their focus away from trying to
• 19:28
  crack heavily fortified financial databases,
• 19:31
  and are instead targeting the marketing stacks
• 19:33
  that hold our behaviors, our search terms, and
• 19:35
  our private desires, are we moving toward a future
• 19:39
  where cybercrime is less about financial theft
• 19:41
  and more about psychological extortion? What
• 19:45
  happens to our privacy when our digital daydreams
• 19:47
  become the new currency for blackmail? Wow. That
• 19:50
  is a deeply unsettling concept to sit with, but
• 19:53
  honestly a necessary one as we navigate these
• 19:56
  platforms. Well... Thank you for joining us on
• 19:59
  this deep dive. Stay curious, stay secure, and
• 20:02
  we'll see you next time.