By Adam Butler, Principal Cyber Solutions Architect

OK, you’ve probably already heard, but if not… On Tuesday morning, a lot of people picked up their phones expecting a nudge about a sale, but instead, the official ASOS app told them, in no uncertain terms, that ASOS had been hacked.

Not a dodgy text from “ASOS-Delivery-Support.co”. Not an email with a typo in the logo. The real app, on a real phone, through the real notification channel. And that, for anyone who has ever run a phishing simulation, should make you put your tea down.

What actually happened

On the 6th October, ASOS app users received a push notification addressed to the company’s DPO and IT team. It claimed a group calling itself “Xuanye” had fully compromised ASOS’s Snowflake instance, threatened to leak data, and pointed readers to a Telegram channel. Public extortion, delivered straight to the customer’s lock screen.

ASOS has since confirmed the incident, saying names and contact details may have been accessed, but it does not believe payment cards or passwords were affected. Snowflake says it found no compromise of its platform. Security researchers have pointed to a marketing platform ASOS uses, which runs on Snowflake, as a likely indirect route. The markets didn’t wait for the forensics: ASOS shares fell by up to 13% on the day.

For balance, much of this is still unverified. The group hasn’t published a data sample, and the investigation is ongoing. It’s also not ASOS’s first brush with trouble this year. A credential stuffing campaign in July hit around 138,800 US customer accounts using passwords stolen from elsewhere. Same theme, different door – someone else’s leak becomes your problem.

When the clues disappear

And I guess all of this got me thinking… for years, security awareness has taught people to play detective. Hover over the link. Check the sender’s domain. Look for the spelling mistake, the odd urgency, the logo that’s slightly the wrong shade of blue. It’s good advice, and it still catches a lot.

But it rests on one assumption: that the attacker is pretending to be someone. The ASOS notification wasn’t pretending. It came from the genuine app, signed and delivered through the genuine channel. Every clue we train people to look for was simply absent.

This is what happens when attackers stop knocking on the front door with a fake moustache and start using the keys. A compromised supplier, a hijacked marketing tool, a legitimate account logged into with stolen credentials. Identity has been the new perimeter for a while now; this is what it looks like when the identity in question is the brand itself. If the source is real, “check the source” stops being a control.

Add AI, and it gets harder still

Now layer AI on top. The spelling mistakes have gone; generative AI writes better English than most of us manage before a second coffee (full disclosure, I used it to review this blog myself). A few seconds of someone’s voice from a webinar or a LinkedIn video is enough to clone it. Deepfake video calls have already convinced finance teams to move serious money, because the “CFO” on screen looked and sounded exactly right.

So the honest position is this: you can no longer reliably verify a message by inspecting the message. The channel can be genuine, the voice can be convincing, the face can be familiar, and it can all still be an attacker.

The answer isn’t to train people to become better forensic analysts of pixels and audio. It’s to stop relying on the message to prove itself and verify out of band instead. Call back on a number you already hold. Confirm through a second, separate channel. Agree something in advance that an attacker simply cannot know!

Codename: Yorkshire Puddings

Which brings me to how you manage this at home… and when do you even bring it up? Like many people, my next big family gathering will be Christmas, which adds its own complexity.

Somewhere between the annual Monopoly meltdown (someone always flips the board, and it’s usually not the kids) and the 3pm nap that nobody admits to, I’ll be having a conversation with my family about verification. Not because I’m a joy at parties (I am), but because the “Hi Mum, I’ve lost my phone, can you send money to this new account?” scam is about to get a voice upgrade. When it sounds exactly like your son, panicking, at 11pm, the hover-over-the-link advice isn’t much use.

So, it’s time for a family code word. Anyone asking for money urgently, by any channel, has to say it. No code word, no transfer, no matter how convincing the voice.

And where did my head go for this code word… “Yorkshire Puddings”. Partly because no AI is going to guess it, and partly because if a genuine family emergency doesn’t involve Yorkshire Puddings, is it really a family emergency? (Obviously, I’ve now published it, so we’ll be changing it. Pick your own, and don’t put it on LinkedIn.)

It sounds daft… and it is daft. It also works, because it moves verification away from “does this look and sound right?” to “do they know the thing only we know?”.

The business version of a code word

The same principle scales to the office, just with less gravy.

Any request to change bank details, make an urgent payment or share sensitive data should trigger a call-back to a known number, not the one in the email. Finance teams should have a two-person rule for anything out of the ordinary, and permission to say “I’ll ring you back” to anyone, including the CEO. Awareness training needs to move beyond spotting fakes to building verification habits that hold up when the fake is flawless.

And the ASOS story has a second lesson: your attack surface includes everyone you’ve connected to. The marketing platform, the CRM, the push notification service. If a supplier holds your customer data or can speak to your customers on your behalf, it needs to sit inside your risk picture, with MFA enforced and access monitored, not just a signed contract in a drawer.

Trust, but verify (with batter)

We’ve spent years teaching people to spot the fake. The next chapter is teaching them that even the real thing needs checking. Have the conversation at work this month, and at home over the turkey.

What’s your family code word going to be?