Asos hack shows your marketing tools hold the warehouse keys

0:05Host:This is MBA Training. On the table: Asos hack shows your marketing tools hold the warehouse keys. "ASOS HACKED." All caps, on your lock screen, sent by the real Asos app.

0:18Expert:Addressed to the company's data protection officer and IT team. Then sent to the customers.

0:25Host:So the ransom note got cc'd to the whole customer base.

0:29Expert:Reply-all, extortion edition. Last Tuesday morning. The message said they had "fully compromised the Snowflake instance" and told Asos to engage or they would leak it. Snowflake is the cloud data warehouse, the big central database where lots of retailers keep their customer data.

0:49Host:And who's "they"?

0:51Expert:A group calling itself Xuanye. Nobody had heard of them before. The notification linked to their Telegram channel, Telegram being the messaging app criminals like because it's easy to broadcast from.

1:03Host:How did the market take it?

1:05Expert:Badly. WWD reported Asos shares closed down about a tenth that day. That's investors pricing in uncertainty. Nobody knew yet what had actually been taken.

1:18Host:So what had been taken?

1:19Expert:Asos first said basic stuff, names and contact details. Then the hackers sent the BBC a sample. TechCrunch, citing the BBC, says it included home addresses, phone numbers, emails, and notes on customer profiles, including what people had searched for on the site.

1:39Host:Hang on, say that again. Search history?

1:42Expert:Search history. Every late-night query you thought stayed between you and a fashion website.

1:49Host:I'm suddenly reviewing my own browsing.

1:51Expert:Your browsing is a governance risk all by itself.

1:55Host:Oh, come on. How did they get in? "Snowflake compromised" sounds enormous.

2:01Expert:It would be, and Snowflake says it didn't happen. Malwarebytes reports Snowflake found no compromise of its platform. Asos's version, reported by BankInfoSecurity, is much more ordinary. Somebody posed as a trusted contact, tricked an employee into handing over real login credentials, and those credentials opened some of the third-party platforms Asos uses.

2:26Host:Social engineering, then. A con.

2:28Expert:A con. Dark Reading's line is that Asos has around 2,800 employees and the attackers needed a single login.

2:37Host:Which platform?

2:38Expert:The hackers told the BBC it was Simon AI. It's a marketing tool that sits on top of Snowflake. Technically it's a customer data platform, meaning software that pulls together everything you know about each shopper so marketing can act on it. Monetate, a Dallas company, owns it.

2:57Host:And what does Simon AI do for Asos?

3:00Expert:I'm so glad you asked. BankInfoSecurity found a case study on the vendor's own site. It boasts that Simon let Asos trigger push notifications based on what shoppers did in the app.

3:12Host:Wait, what? The tool sold to send push notifications... sent a push notification.

3:18Expert:Working as designed. The case study was about increasing shopper engagement.

3:24Host:By all accounts, engagement went through the roof.

3:28Expert:Best open rate in company history, I'd guess.

3:31Host:Okay, the MFA part. Everybody on my feed is shouting about it.

3:36Expert:MFA is multi-factor authentication, the second check after your password, like a code on your phone. Kevin Beaumont, a British security researcher, posted that Simon AI connects directly into Snowflake but doesn't require MFA, and it isn't switched on by default. He also said the login portal is all over infostealer logs. Those are dumps of passwords that malware has scraped off infected laptops and that criminals trade with each other.

4:06Host:And he called it the way in.

4:09Expert:He did, word for word: "This was the route into Asos." But keep the facts separate. That's his assessment. Dark Reading says neither Asos nor independent researchers have confirmed the Simon AI detail. Malwarebytes says the reporting doesn't establish a vulnerability in Snowflake or in Simon AI. And Asos hasn't named the platform.

4:33Host:Isn't this the old Snowflake password mess all over again?

4:36Expert:Beaumont makes that exact link. Snowflake had this problem before and made MFA mandatory. His point is that Simon AI hasn't, and it connects to the same data. So you put a vault door on the front, and marketing has a garden gate with the key under the mat.

4:54Host:This is where I push back. That's the vendor's fault. You plug a tool into a retailer's entire customer base and MFA is optional? That's on Monetate.

5:05Expert:Partly. Optional MFA on a tool that can read your warehouse is a bad default, and I'd tell them so to their face. But the setting existed. Beaumont even linked the guide for turning it on.

5:18Host:Oh, so now we blame the customer.

5:21Expert:We blame whoever owns the connection. In most companies, nobody does. Marketing bought it, IT approved it once, data engineering wired it to the warehouse, and security never saw the login page.

5:34Host:Would MFA even have saved them? They conned an employee. If you can talk someone out of a password, you can talk them out of a code.

5:42Expert:Fair, and it's the strongest counter-argument. I don't have a clean answer. MFA stops someone replaying a password they found in a malware dump. It's much weaker against a live con where the employee reads the code out loud. It makes the attack harder. It doesn't make you safe.

6:02Host:So the MFA crowd is overselling it.

6:05Expert:The MFA crowd is right that it's the floor. You're right that it's not the ceiling. I'm still making it mandatory.

6:12Host:And I'm still blaming the vendor.

6:14Expert:Noted. Minuted. Ignored.

6:17Host:Fine. Why is this a data leader's problem and not just the CISO's? The chief information security officer gets paid for this.

6:27Expert:Because what got abused was a data product. Simon AI calls itself a composable CDP. Composable means it doesn't copy your data into its own database, it reads straight from your warehouse. Data teams love that pitch: one source of truth, no copies drifting around. The flip side is that the marketing tool's login is now a login to your warehouse. And this one could also message customers.

6:54Host:Read the crown jewels and talk to every customer, from a single account.

6:59Expert:That combination is why it blew up in public. As Malwarebytes put it, customers heard about the breach from the criminals before they heard it from the retailer. You can't run a quiet incident response when the attacker has your megaphone.

7:14Host:That part makes me wince. Somewhere at Asos, someone answered a message that seemed totally normal, and now it's their week.

7:22Expert:Yeah. I feel for that person. It sounded routine, it always does. Blaming them is easy and fixes nothing.

7:31Host:What's still unknown?

7:32Expert:The route, and the scale. Asos hasn't said how many people are affected. Dark Reading puts its customer base at around 17 million, so treat that as the ceiling, not the count.

7:45Host:And what do the hackers want?

7:47Expert:Money, presumably. On Telegram they said the app is safe to use and payment data wasn't touched.

7:54Host:Customer service from your extortionist. Lovely.

7:58Expert:Polite, with a deadline. Dark Reading says they told The Telegraph they'd leave the data alone for two weeks. So the clock is running, and nobody outside the room knows exactly when it started.

8:11Host:Wasn't there an earlier Asos incident too?

8:13Expert:In the US, back in July. That was credential stuffing, meaning attackers trying passwords leaked from other sites. Check Point told Dark Reading it looks unrelated. Don't merge the stories just because the logo matches.

8:28Host:Right. Give me the Monday action. And don't say "review your security posture."

8:34Expert:God, no. This week, ask your data engineering lead for a list of every third-party tool that holds credentials into your warehouse. Ask two questions about each one. Is MFA enforced, or just available? And can this tool also send messages to customers? Anything that answers "optional" and "yes" goes to the top of the list. Before Friday, you turn on MFA or put it behind single sign-on, meaning people log in through your company's own identity system.

9:07Host:And when marketing says that slows down campaigns?

9:10Expert:Show them the case study. It promised to trigger push notifications. Somebody did.

9:15Host:Engagement through the roof.

9:18Expert:Best open rate they'll ever have.

9:20Host:Drawn from Bank Info Security, WWD and Malwarebytes, links in the show notes. We'll leave it there. The CDO self-assessment at mba-training.com will tell you where you really stand.