When attackers take control of crisis communications: a cyberattack announced via a push notification
Online shops usually use push notifications for discount codes, delivery updates and new collections. Recently, millions of people received a very different message from the ASOS app: ASOS had fallen victim to a cyberattack. However, the message did not come from ASOS, but from the attackers themselves.
This meant that crisis communication had already failed before the company had even issued a statement. The ASOS hack shows just how quickly a company can lose control of its own narrative. And it highlights the gaps in technology, processes and communication that lie behind it.
The attack began with social engineering, not a security vulnerability
There is no official forensic report as yet. As things stand, the attackers used phishing to obtain the login credentials of an ASOS employee – reportedly a new recruit, according to media reports. This gave them access to a SaaS platform containing marketing data: names, email addresses and telephone numbers. According to the information available so far, they did not have access to the entire corporate network.
This was followed by a classic blackmail attempt. The group demanded Bitcoin and set a deadline of around two weeks, threatening to publish the data otherwise. When nothing happened, they ramped up the pressure in an unusual way: they sent a push notification to customers via the ASOS app. In it, they also named Snowflake as a compromised platform. Snowflake has denied this, and ASOS has not confirmed the breach either.
Making blackmail involving stolen email addresses public is nothing new. Announcing an attack via the victim’s own push notification channel, however, is. The attackers exploited the very channel that is normally used to build customer loyalty.
Awareness reduces the risk, but does not eliminate it
Social engineering sounds like a problem that can be solved with training. In practice, it is more complicated. Skilled attackers do not make random calls. They research in advance which software is in use, who reports to whom, and who holds which position. Much of this information is publicly available on LinkedIn. Armed with this knowledge, a call comes across as credible and creates pressure, particularly for staff who have never experienced such a situation before.
Even multi-factor authentication has its limitations here. Anyone who reveals their password over the phone will often go on to disclose the code as well. Training therefore remains important, but it is only one layer of protection amongst many.
Technology and processes could have detected the attack earlier
A key factor is simply reporting the incident. Anyone who has disclosed their login details over the phone sometimes only realises hours later that something was amiss. It must therefore be made clear that such incidents should be reported and that this can be done without fear of repercussions.
Technically, there are several levers to adjust:
MFA without ‘stay logged in’: If devices are not permanently stored, attackers must obtain a new code every time they log in.
Automatic logout: Inactive sessions are terminated after a short period.
Monitoring of authentication logs: Logins from unexpected countries or networks are flagged before anyone can cause significant damage.
Alerts for configuration changes: Anyone who disables approval processes or changes administrators’ email addresses triggers a notification.
This monitoring is often lacking, particularly with SaaS platforms that run outside the traditional corporate network.
The dual-control principle applies to bank transfers, but often not to mass messages
In many companies, bank transfers above a certain amount are checked by two people. For a message sent to millions of customers, however, such an approval process is apparently often absent. As a result, companies protect their money more effectively than their reputation.
Yet this can be easily resolved. One person drafts the message, a second approves it. This requires a clear role-based system: not every login to a CRM or marketing platform should authorise sending a message to the entire customer base. An admin can, of course, override such workflows. But this should then trigger a notification.
If you remain silent for too long, you leave the narrative to others
Perhaps the most important aspect of the case concerns crisis communication. ASOS was aware of the blackmail before the push notification was sent. Nevertheless, the company failed to communicate. Perhaps they did not take the threat from a new group with no history seriously enough. However, anyone who cannot reliably verify whether someone has accessed their own systems should take such a threat seriously.
The consequences were clear: according to reports, the BBC was already broadcasting live coverage of the incident before ASOS had issued a statement. Hours passed before the first statement was released. And initially, this statement only referred to an unauthorised notification, not a cyberattack, even though that was precisely what was stated in the attackers’ message.
Anything that’s going to be published anyway loses its impact if the company tells the story itself first. This requires prepared playbooks. If it’s established in advance that a statement will be issued in the event of an emergency – who will approve it and through which channels it will be disseminated – the question ‘Should we say something or not?’ doesn’t even arise.
The damage to reputation is real, but often short-lived
On the stock market, ASOS shares fell by around ten per cent immediately. That’s a lot, but it only shows part of the picture. Reputational damage is severe at first but often subsides quickly. At CrowdStrike, the share price initially plummeted following the faulty update, which, amongst other things, paralysed airports. Today, it is trading higher than before.
The impact of an incident depends on the sector. In the fashion retail sector, unsettled customers quickly shop elsewhere, and turnover is affected immediately. In mechanical engineering, order books are often full for long periods, so other scenarios have a greater impact there. A production halt caused by ransomware can drive customers permanently to the competition. Stolen research data can devalue a product before it even reaches the market.
That is why a business impact analysis tailored to your own business model is an essential part of your toolkit. It reveals which attack scenarios really cause damage.
This group is unlikely to be making its last appearance
The group behind the ASOS hack is new. According to Group-IB, their communication channel under this name has not been in existence for long; previously, Counter-Strike skins, amongst other things, were traded there. A well-known British security researcher aptly referred to them as ‘Advanced Persistent Teenagers’.
Nevertheless, they should not be underestimated. According to media reports, the group is also linked to incidents at KLM and H&M. Their targets are large corporations; the group does not shy away from attention, and the high-profile campaign also appears to be a form of self-promotion. It is quite possible that they will further develop their tactics, perhaps moving towards ransomware or CEO fraud.
For businesses, this means that detection and response, awareness and a prepared crisis communication strategy go hand in hand. Only together do they make a company resilient.
In the latest episode of Cybersecurity Basement, Michael and Andreas discuss the ASOS hack in detail. They explain how the attackers went about it and what went wrong with the crisis communication.