Earlier this month, ASOS customers received an app notification from the retailer that they weren’t expecting. It wasn’t a message about a new sale or upcoming delivery. It was a ransom note.
Most attacks like this happen out of customers’ sight, but this one appeared directly on their phone screens.
ASOS has said no card details or passwords were accessed. While we won’t know the full extent of the attack until a full investigation is concluded, the data the hackers claim to hold – names, addresses, contact details and search history – is exactly what criminals need to write a convincing phishing message or take over an account.
This is often where the real cost of a breach shows up – weeks later and at the checkout.
The incident raises a question that every customer asks after a breach: how can I be sure my details weren’t compromised? There’s often no definitive answer, at least until all investigations are completed. But it serves as a reminder for businesses that, as their touchpoints with customers grow and evolve, so must their approach to security – covering every step of the customer journey, from login, through product discovery, to purchase.
Trust can be lost in a notification
Retail runs on trust, and the ASOS hack goes straight to the heart of why it matters so much, how quickly it can be lost and how long it can take to rebuild.
Customers are more used to reading about high-profile breaches in the news, but being made part of the attack in real time via their phones brings the whole situation closer to home than they’ve likely ever experienced.
It’s also a symptom of how modern retail now works. Apps, marketplaces, loyalty schemes and third-party data platforms hold more personal data on consumers than ever and are all part of the modern shopping experience.
Retailers increasingly rely on complex digital networks spanning e-commerce platforms, marketing tools, logistics providers and payment gateways. Rather than attack a retailer’s systems head-on, criminals often go after the partners around them and the people who manage those relationships. Every retailer needs to know exactly who can access their customers’ data, who can message their customers and how fast they could cut off access.
Another lesson for retailers to heed is the importance of transparency and clear communication. When a breach does happen, being clear about what is known, what isn’t and what customers should do next protects trust far better than silence. Attackers who are willing to go public will fill any gap a retailer leaves.
Shoppers will trade speed for security
For many retailers, there’s an assumption that as little friction as possible in the purchasing process is the key to winning customers and securing conversions at the checkout. But nearly three-quarters (71%) of European consumers told us they want stronger security checks, even if it slows down the checkout process.
This is a clear message for retailers – customers want seamless experiences but not at any cost. For them, feeling safe and confident in their purchases is just as important, if not more so.
Harnessing technology to fight back
Retailers also need to harness the power of technology as they look to fight back against the bad actors. Our research reveals 84% of retailers operating across Europe would like better technology to support their security initiatives, while 76% are planning to invest more in fraud prevention tools moving forward.
In practice, that means phishing-resistant multi-factor authentication on every tool that can reach customers, not just core systems; the ability to revoke a partner’s access in minutes, not days; and monitoring that flags potential second waves – spikes in account takeover attempts, unusual logins and suspicious transactions – before they turn into losses.
This is where trusted payment partners can play a bigger role, helping retailers promote tokenised cards and digital wallets which store sensitive card data in secure payments infrastructure rather than in a retailer’s own systems, minimising the impact in case of a compromise.
In the aftermath of a breach, payments providers can help identify patterns across many merchants that no single retailer can see on its own. Sharing that intelligence and building it into the checkout gives merchants protection that keeps pace with their growing ecosystem of partners.
Attacks like the one on ASOS often happen quickly and can seem to be over in little time. But for retailers who suffer a breach, the bigger risks are often what comes next, when any customer data accessed is used for follow-up phishing attempts, account takeovers and other illicit activity.
Combatting cyber threats demands an always-on approach. The retailers that treat every partner, every channel and every customer touchpoint as part of their security will be the ones that are best placed to keep their customers’ trust.
Join our LinkedIn group Information Security Community!
——————————————————-
Click Here For The Original Source.
