A legal expert says employers should design cyber security systems on the assumption that employees could be deceived following an ASOS hack.Last week, an ASOS employee was tricked into handing over their credentials to a hacker who pretended to be a trusted contact.Customers received a chilling hack notification about 8pm on Tuesday October 6, that appeared to be from British online shopping giant ASOS warning of a hack.“Dear ASOS DPO and IT, we have fully compromised the Snowflake instance,” the hackers’ chilling message to the ASOS team read.“Engage with us, or we will leak it.”The online shopping giant confirmed some personal information had been accessed during the hack, including names and contact details, as well as certain non-personal account related information. A week after the hack, an ASOS spokesman confirmed an unauthorised third party logged into an ASOS employee’s account by “impersonating a trusted contact” to obtain the log-in details. “The affected platforms were immediately locked down, ensuring that no further information could be accessed and a full investigation was launched with the support of both internal and external cyber experts,” they said. ASOS serves about 16.7 million active customers, with Australia one of the largest international markets for the e-commerce platform.It is not known how many customers were impacted by the hack.Further investigations into the hack found that no payment card information or password details were accessed.“The ASOS website and app were safe to use throughout, and remain safe to use today,” the update read. “There is no action you need to take on your account. However, please remain cautious of unexpected messages or calls claiming to be from ASOS.” LegalVision practice group leader Joel Hayden said social engineering attacks work because they exploited trust, urgency and routine business processes — not simply because staff were careless.“The best protection is layered: phishing training, multi-factor authentication, least-privilege access, password managers, payment-change verification, fast reporting channels and clear incident response steps,” he said.“A blame-first culture can make breaches worse because employees may delay reporting for fear of being punished. “The most useful message to staff is: report quickly, even if you think you made a mistake. Speed can reduce the damage.”Mr Hayden said it would be unlikely an employee would be dismissed over a cyber security breach, unless they acted recklessly or were involved in deliberate conduct.“A dismissal is harder to defend where the breach was a genuine mistake and the employer had weak systems, unclear policies or poor training,” he said.“Employers should investigate first, assess the seriousness of the conduct, consider the employee’s history, and follow a fair process before deciding on dismissal.“Employees could face legal action in serious cases, but it is uncommon for employers to sue staff over an honest mistake. “Legal risk is more realistic where the employee acted deliberately, stole data, misused confidential information, accessed systems without authorisation, or caused loss through reckless conduct.”
Click Here For The Original Source.
——————————————————–
