Cyber criminals used Asos's own app system to send a pop-up notification to potentially millions of the retailer's customers, in a breach that made global headlines on Tuesday. The UK's National Cyber Security Centre offered the company assistance, the BBC understands.
The NCSC was marking its tenth anniversary the same week. In a letter to the agency, King Charles III wrote that "malicious actors" continue to "evolve their tactics by using automated technologies", and that strong cyber security is "fundamental to making the online environment safer and more resilient". The agency was established in 2016 as part of GCHQ.
Why the channel matters more than the message
Most fraud reaches people through email and SMS, and most people have learned — unevenly, but they have learned — to distrust both. A link in a text message from an unknown number now gets a second look from a lot of users who would have tapped it five years ago.
A push notification is different, and the difference is not technical. It is that the notification arrives having already passed every check the user believes in. It appears under the app's own name and icon. It is on the phone's lock screen among messages from people they know. There is no sender address to inspect, no domain to squint at, no forwarding chain. The thing that normally does the work of reassurance — this came from the real app — is, in this case, true.
That is why using a retailer's own notification system is a meaningful escalation rather than just another breach. It borrows the trust the company spent years building, and it strips the user of the signals they would normally use.
What a shopper can actually do
Almost none of the standard advice works here, which is worth saying plainly rather than repeating it.
You cannot check the sender. You cannot hover over the link. Telling people to "look carefully at the URL" assumes a URL is visible before the tap, and in a notification it usually is not.
What remains is a single habit, and it is the only one that survives this attack: never act from a notification — act from the app or the site you opened yourself. If a message says there is a problem with an order, a refund waiting or a password to reset, close it, open the app from your home screen, and look. A real message will be there. A fake one will not.
That rule costs about four seconds and it defeats the entire class of attack, including ones that have not been invented yet.
The part Bangladeshi companies should read
Every bank, mobile financial service and e-commerce app in Bangladesh has a push notification channel, and in most organisations it is operated by marketing rather than by security.
That is the exposure. The credentials for a notification console tend to be shared, rarely rotated, often held by an outside agency running campaigns, and almost never covered by the multi-factor requirements applied to core banking systems — because the console is thought of as a marketing tool, not as a direct line to several million lock screens.
It is worth an organisation asking three questions this week: who can send a notification to all users, how many of those people are outside the company, and would anyone notice an unscheduled send before customers started calling.
What the notification itself tells investigators
One detail decides how bad a breach like this is, and it is not the wording of the message.
A notification console is a send tool. Reaching it proves someone got into a marketing system; it does not, on its own, prove they reached customer records. Those are usually separate systems with separate credentials, and a company able to say so quickly is saying something meaningful rather than reassuring.
So the question to watch in any such incident is narrow: did the attacker only send, or did they also read? Until a company answers that specifically, "we are investigating" covers both a nuisance and a serious data loss, and customers cannot tell which one they are in.
On how breaches reach people here, see the account safety checklist and the data-breach claim involving agents' records.
