On Tuesday morning, October 6, ASOS app users in the UK got a push notification titled "ASOS HACKED." It linked to a Telegram account, and the message claimed the attackers had fully compromised ASOS's Snowflake instance. ASOS's customer update describes unauthorized activity involving third-party platforms it uses to communicate with customers, and it hasn't confirmed the Snowflake claim. That evening it emailed customers an apology saying names and contact details may have been accessed. It doesn't believe payment details or account passwords were affected, and it told customers not to click on or engage with any related links. The next day, the ICO issued a statement about ASOS telling people to be cautious with unexpected links and to use strong, unique passwords and MFA.
ASOS serves 17 million customers in more than 150 markets, and we still don't know how many of them are affected or exactly which details were exposed. Black Friday is November 27. If you run security for a large organization, in retail or anywhere else, you're heading into those weeks deciding what to change for the holidays: another tool, stricter email filters, or both.
My view is that the filters and the tool stack should stay where they are, and the extra effort should go into your people. A breach like this sends me looking at people first, and data stolen from a retailer comes back as phishing aimed at people, yours included.
Key Takeaways
- Mandiant's investigation into the 2024 Snowflake campaign revealed that attackers compromised approximately 165 organizations through client accounts lacking multi-factor authentication rather than breaching Snowflake's enterprise environment.
- Verizon's 2026 retail snapshot reports that 68% of retail cybersecurity breaches involve a third-party vendor platform, while 58% are facilitated by a human element.
- Phone-based social engineering lures, such as voice calls and text messages, achieve a median success rate 40% higher than traditional email phishing campaigns according to Verizon simulation data.
- Semperis research indicates that 52% of reported ransomware attacks occur on weekends or holidays, periods when 78% of surveyed companies reduce Security Operations Center staffing by at least half.
- Imperva's 2025 Bad Bot Report documented a 79% year-over-year increase in account takeover attacks during the pre-holiday shopping months of September, October, and November 2024.
- Chief Information Security Officers should maintain continuous baseline email security filters during peak retail seasons, as temporarily tightening parameters increases false positives that disrupt critical business operations.
What Does an Unauthorized Push Notification Indicate About Compromised User Credentials?
When an attacker can push a message through a company's own app, the first thing I think of is a user who was compromised in some manner. That's always the first thing these days. Attackers today are looking for credentials, right? They're looking for ways of bypassing MFA and other security tools by getting credentials from users. ASOS hasn't said how anyone got in, and its update doesn't point to a compromised employee account, so this is only where I'd start looking.
The way they get those credentials has moved on. In the old days, and by the old days I mean just a few years ago, attackers would drive users to login pages just to capture their login info. Today they're on another layer. They send fake MFA requests and ask users to comply. Every approval gets them a deeper level of access, past the tools that were meant to be the second, third and fourth line of defense. The attacker is counting on someone tapping "approve" without stopping to judge the prompt.
How Do Retail Account Breaches Occur When Third-Party Vendor Platforms Remain Secure?
Snowflake opened its own investigation and says it found no compromise of its platform. That can be true, and a customer can still get breached. The 2024 campaign against Snowflake customers worked exactly that way. Mandiant and Snowflake notified about 165 organizations that were potentially exposed, and Mandiant found no evidence the campaign began with a breach of Snowflake's own enterprise environment. What let the attackers in was a mix of customer accounts without MFA, credentials left valid for years and missing network allowlists. The oldest related infostealer infection Mandiant found went back to November 2020.
So when a vendor says its system is fine, I look at the customer's own people. They aren't the only way in. Verizon's latest retail snapshot puts vulnerability exploitation well ahead of credential abuse as an entry point, but it also finds a third party involved in 68% of retail breaches and a human element in 58%. The Snowflake campaign had both: a vendor's platform and the customers' own logins.
Which Retail Employees Are Most Targeted by Social Engineering Impersonation Attacks?
Usually, employees are susceptible to impersonation. Someone posing as IT tries to get information out of them with a deepfake voice call, a phishing email or a fake QR code. The MGM hack, conducted by Scattered Spider, started with a phone call from someone impersonating an IT person.
It's usually the people with the access. Sometimes any access will do, because a foot in the door takes you pretty much anywhere. But usually attackers target the most delicate positions: people in finance who have access to privileged information, middle and upper management, and executive personal assistants. Those roles hold the access keys to critical internal data.
The MGM call never went near an email filter. In Verizon's simulation data, phone-based lures like voice calls and texts had a median success rate 40% higher than email, and tightening your email filters for the holidays does nothing about either.
Why Are Retail Cybersecurity Attacks Most Prevalent During the Black Friday Holiday Season?
Retail and consumer brands have had a rough stretch. Harrods, Marks & Spencer and the Co-op were all hit by ransomware in 2025, and earlier this year a Booking.com breach exposed customer names, emails, phone numbers and booking details. ASOS has now been hit just before the weeks when shoppers are easiest to rush.
Black Friday is ripe with cyberattacks that involve mainly phishing, and people are very susceptible at this moment. They're on a shopping spree, caught up in the whole shopping frenzy and the anxiety that it brings. Any urgent request bypasses those mental blocks that we have on regular days of the year, when we don't feel anxious about shopping.
Semperis found that 52% of reported ransomware attacks landed on a weekend or holiday, and that 78% of the companies it surveyed cut SOC staffing by at least half during those periods. Thanksgiving weekend is a holiday and a weekend at once, with Black Friday in the middle of it. That weekend, anything that slips through gets judged by an employee in a shopping frenzy, with fewer analysts behind them.
How Do Cybercriminals Use Stolen Retail Data and AI for Personalized Phishing Campaigns?
The Black Friday lures aimed at individuals are familiar: fake gift cards, fake UPS or shipping messages about packages that could not be delivered, fake Amazon promotions for something very appealing, like an iPhone for $100. Everybody's expecting a package this time of the year. Deloitte forecasts $1.70 to $1.71 trillion in US holiday retail sales, with e-commerce up 7.5% to 8.4%, which is a lot of real packages for a fake delivery notice to hide among.
When an organization's databases are compromised, attackers have access to pretty much every piece of customer data, and they can use it to make those lures personal. When you shop, you leave your phone number, your rewards program, your full name, your home address in the case of online retail, and your shopping history. ASOS says names and contact details may have been accessed, and the full list is still unknown. Combined with the scalability of AI, that kind of information can be used to craft highly personalized messages en masse.
Say Peter is an avid Apple user, and his shopping history shows he buys Apple from a certain store. He gets an email saying, hey, the latest iPad, half off. He doesn't stop and think too much about it. He acts on it, because it's urgent and he may miss the offer. That's a very efficient way of leveraging stolen data, and AI can write that email for every Peter in the database.
Peter has a work inbox too. Employees are receiving these kinds of emails on their corporate accounts as well, right? Training them to hunt for typos and odd sender domains is actively dangerous when AI is writing the emails. People manipulation can be grammatically perfect, can have the right sender, and still create a severe data breach. Training employees for context and not just for markers means Peter asks whether a half-price iPad from his usual store makes sense at all.
Why Should CISOs Maintain Baseline Email Security Filters During Peak Retail Holiday Seasons?
In peak season, a false positive costs something real, like a blocked supplier email or a stuck order. So the pressure on a CISO runs both ways: tighten the filters because the threat is up, or loosen them so the business keeps moving. I don't think any CISO should tighten the rules or loosen the rules. That decision shouldn't be made based on seasonality or specific cases. It should hold across the board.
Overly strict filtering is like dropping a highway's speed limit to 10 mph. You'd drastically cut the accidents, and you'd also bring traffic to a crawl. The false positives halt the business, and each one turns into work for your SOC. I'd calibrate email security to a baseline plateau, a sensible level you keep all year, and let employees' well-trained common sense deal with whatever gets past it. Tech works on parameters, and modern social engineering knows how to bypass parameters and fool people.
Buying another tool for the season comes from the same place. It's easier to program software than to change human behavior, so the tool feels like progress. It becomes a race towards zero, because leaders are just stacking software that gives them signals but doesn't give them the solutions.
What should change with the season is how you distribute security awareness through the year. You identify the weakest spots, both in knowledge gaps and in the time of year. It makes a lot of sense that a company is more vulnerable at the end of the fiscal year, for example. Everybody is on a deadline, under tight pressure to deliver the numbers, and no one is paying close attention to that loose email that impersonates someone. The same applies to people outside work. End-of-year shopping is the time for these attacks, and that's when attention matters the most.
In Imperva's bad bot research, account takeover attacks rose 79% year over year in each of September, October and November 2024. That whole run-up belongs to the season too, and I'd spread the extra awareness work across it.
How Should Employees Apply Cybersecurity Awareness Training Across Corporate and Personal Environments?
Before the long weekend, the message I'd want every employee to hear is that the rules in the real world are the same as in the corporate world. Hopefully your people get regular and timely security awareness training, so they already know those rules. Stop, think about it, be suspicious of too-good-to-be-true offers, and don't fall for urgent requests. Whatever message they get, at work or on a shopping app, they should check that it makes sense. Is it too good to be true, or too urgent for this kind of communication?
At work, the same reflex covers impersonation. Stop and check before you comply. And if it's unusual, that goes double. If a call that claims to be from IT or from an executive asks for something odd or out of context, hang up and contact that person directly. If the confirmation takes longer than a day and no one follows up, it was never urgent or it was never real.
That reflex holds only when leaders back it. They need to take part in the learning themselves, and middle and upper management belong in it because their access is what makes them targets. They also need to support the employee who stuck to procedure and questioned an urgent request.
Why Should SOCs Prioritize Measuring Actual Behavioral Cybersecurity Violations Over Simulation Scores?
The metric I care about most is the number of actual behavioral violations your SOC records. Set baselines and benchmarks for every type of risky behavior, in every department, and watch whether those real-life violations go down. Real life always wins, and it always should, so that count matters more than any simulation score.
Simulations still have a job, because they give people the theory. The other half of a two-headed approach is targeted training triggered by the risky behaviors your security stack detects, so the lesson reaches the person who did the risky thing, about that exact thing.
At Right-Hand Cybersecurity, we've helped multiple customers build a proactive security culture, and the result was a measurable surge in employee-driven reporting of potential threats. I read that kind of surge as a sign of a healthy security culture, even if more safe items get flagged by mistake.
ASOS told its customers not to click on or engage with any related links, and the ICO asked people to be cautious with unexpected ones. Between now and the end of the season, your employees will get messages that look nothing like a breach notice: a half-price iPad from the store they always buy from, a fake gift card, a call from "IT" about an MFA prompt. The ones your filters miss, and every one of the calls, will land in front of someone who's expecting a package and doesn't want to miss the offer.
Frequently Asked Questions
How should enterprise SOCs adapt incident response when a vendor denies systemic compromise during a breach?
Pivot immediately to identity investigations. A Mandiant report found 79.7% of accounts in the 2024 Snowflake campaign had prior credential exposure. When vendors deny systemic failure, assume human perimeter failure. Cross-reference access logs against human risk metrics to accelerate MTTD and automate credential quarantines.
Why should CISOs prioritize human behavioral risk when vulnerability exploitation is statistically surging?
Because the human element bridges the gap between exploited systems and lateral movement. While Verizon's 2026 DBIR notes vulnerability exploitation reached 31%, 58% of retail breaches still involve the human element. Real-time behavioral interventions prevent attackers from escalating privileges after exploiting an unpatched perimeter.
How can security leaders mitigate alert fatigue during peak threat windows with reduced SOC staffing?
Integrate human risk management directly into your automated security stack. Semperis found 78% of companies cut SOC staffing by half during holidays, when 52% of ransomware strikes. Replacing manual triage with automated employee interventions filters low-level phishing noise, allowing your skeletal SOC to focus purely on high-fidelity alerts.
How does the theft of non-payment internal retail data accelerate lateral credential attacks?
Stolen internal records provide the precise organizational context needed to bypass behavioral defenses. Verizon's 2026 data shows internal data was compromised in 84% of retail breaches. Cybercriminals weaponize this intelligence to craft hyper-personalized lateral phishing that bypasses gateways, requiring proactive, real-time employee coaching to detect.
Why is integrating human risk data with existing ecosystems critical after third-party exposures like the ASOS incident?
Siloed security awareness leaves blind spots. The ASOS incident highlighted vulnerabilities in third-party platforms. By aligning human risk management with Cybersecurity Mesh Architecture, CISOs can leverage existing workspace telemetry to automate behavioral interventions exactly when an employee interacts with a compromised vendor, directly reducing SOC alert fatigue.
