Count the logins that can reach your customers.

The alert came from the store's own app

On Tuesday, people with the ASOS app on their phones in the UK, Ireland, the US and elsewhere got a notification that looked like any other ASOS alert. It said, in effect: we've hacked you, talk to us or we leak the data. It was addressed to ASOS's own data protection and IT staff, and it went to customers because the attackers had control of the tool ASOS uses to send those alerts.

By Thursday the picture was clearer, and worse than the first statement. ASOS told customers an attacker had got into an employee account "by impersonating a trusted contact to obtain log in credentials," then used that login on "certain third-party platforms." A sample the attackers sent the BBC included names, home addresses, phone numbers, emails, customer numbers, dates of birth, and the searches people had typed into the ASOS site. ASOS says card details and passwords weren't taken.

The attackers told the BBC they got the data through Simon AI, a marketing personalization platform that runs on top of ASOS's Snowflake data warehouse. Snowflake says its platform wasn't breached, and none of the reporting so far shows a flaw in either product. What it shows is simpler. Someone got a working password to a tool that could see a great deal of customer data and could message customers directly. The security researcher Kevin Beaumont pointed out that the platform's login doesn't require a second sign-in step by default, and that its login page is "all over infostealer logs."

You are probably not ASOS. But the shape of this is very common, and it's worth an afternoon to check whether you have it.

Follow one login

Think about the tools around your store rather than the store itself. Even a modest online store usually has more of them than anyone has written down: an email and text platform, push notifications, reviews, loyalty, the help desk, analytics, maybe a data warehouse and a personalization tool on top of it, plus the dashboard your agency uses. Each one gets a copy of some of your customer data, and each one has its own login page.

Most of them were set up by someone in a hurry. A marketer connecting a new app before a launch, an agency wiring up a campaign, a developer turning on a sync with every field ticked because it was easier than choosing. Nobody did anything wrong. It's just that the store got a security review and the tools around it didn't.

So here's the exercise. Pick one tool. Imagine someone else has the password for one account on it. Now follow that login. What can they see? Can they download it? And can they send something to your customers?

That last question is the one ASOS makes impossible to ignore. Losing a customer list is bad. Having your own app or email account tell potentially millions of people you've been hacked, before you've said a word, is a different kind of bad. Malwarebytes, citing the Independent, reports that ASOS's full statement came about five hours after the alert went out. For those hours, the attackers were the ones talking to its customers.

Three questions for every tool

You can do this in a spreadsheet with one row per tool. For each, find out three things.

What can it see, and can it take it out? Not "does it have customer data" but which fields. Names and emails are one thing. Birthdays, addresses, order history and on-site searches are another. Then check whether any user can export, or only a few, and whether exports are logged anywhere you'd notice.

Can it send to your customers? Email, texts, push notifications, on-site banners, review requests. If it can send, check who's allowed to send to the whole list, and whether a big send needs a second person to approve it.

Who logs in, and how? One named account per person, or a shared team login on a sticky note? Is a second sign-in step required for everyone, optional, or not offered at all? Can it use your company sign-in, so that when someone leaves, one switch turns off every tool at once? If you've read our note on the accounts nobody listed when someone leaves, this is the same list, looked at from the other side.

You'll usually find that two or three tools are the ones that matter most: the ones that can both see a lot and send to everyone. Start there.

Optional means off

A second sign-in step that is "available" is, in practice, off for most of the accounts that need it. Somebody has to go into each user's settings and turn it on, and then somebody has to check it stayed on. That's why Beaumont's point about defaults matters more than any detail about the attackers. Snowflake made the second step mandatory for new accounts in 2024, after attackers got into about 165 customer accounts that weren't using it. Plenty of the tools built around it never followed.

The "infostealer logs" part is worth translating too. Infostealers are a kind of malware that quietly copies the passwords saved in a browser and uploads them. They mostly live on personal laptops and home computers, often the same machine someone uses to check the work email or log into the marketing dashboard in the evening. The stolen passwords get bundled and sold. When a researcher says a login page is all over those logs, it means a lot of real working passwords for it are already out there.

For each tool on your list, then: make the second step required for every account, not offered. Where the tool supports your company sign-in, use it. And for the small number of accounts that can export everything or message every customer, use the strongest option the tool has, such as a passkey or a security key, because ASOS also shows that people can be talked out of a code over the phone by someone who sounds like a trusted contact.

If a tool that holds your customer data can't require a second step at all, that's no longer a setting. It's a buying question, and it belongs in the next renewal conversation.

Send each tool less, and plan for the hijacked channel

The second fix is about how much is there to lose. Look at what each tool is actually syncing against what it actually uses. A tool that sends abandoned-cart emails needs an email address, a first name and the cart. It doesn't obviously need a date of birth or every search a customer has ever typed. Malwarebytes made the point that the searches in the ASOS sample are exactly what makes a scam email convincing, because a message that knows what you were shopping for feels real. Fewer fields in fewer places means less to lose when one login goes.

The third fix is the one almost nobody does ahead of time: decide what happens if one of your sending channels is used against you. Who can switch off push notifications, or pause all email sending, in five minutes, on a Sunday? Is that person's login one of the ones you just protected? Where does a short holding statement go first, so customers hear from you before they hear from anyone else? None of this needs a big incident plan. It needs three names and a page.

An afternoon this month

Here's a realistic version. Book two hours with whoever runs marketing, whoever looks after the site, and your agency if you have one. Fill in the spreadsheet together: every tool, what it sees, whether it exports, whether it sends, how people log in. Then fix the two or three tools that can see a lot and send to everyone, before you touch the rest.

If you want a few questions to bring to that meeting:

• Which tools could send something to our whole customer list today, and who has the login for each?
• On which of them is a second sign-in step required for every account, and how do we know?
• If one of those tools started sending messages we didn't write, who would switch it off, and how long would that take?

This is the kind of thing we look at whenever we build or move a store, because the integrations list is part of the build, not an afterthought. If your list turns out longer than expected and you'd like help sorting it, our ecommerce work covers exactly that, and you can get in touch here.

Related work: Sutton Place