There is a particular dread reserved for a push notification that arrives from a company you trust and reads like a ransom note. Asos customers in the United Kingdom and Australia got one in the first week of October, delivered through the retailer’s own app, announcing that their data had been taken. The message did not come from Asos. It came through Asos, which is a different sentence and a considerably worse one.
What followed was the part that will be studied. The retailer said it was investigating. It did not immediately confirm what had been accessed, by whom, or whether the notification’s claims were true. Britain’s National Cyber Security Centre put up guidance for Asos customers, which is the digital equivalent of the fire brigade arriving before the building’s own alarm has made up its mind. For a stretch of hours that felt much longer to anyone holding a phone, the only party speaking with confidence about an Asos incident was the party claiming to have caused it.
Anyone who has stood at a good espresso bar knows the shape of this failure. A barista pulling a bad shot tastes it, tips it, and says so before the cup reaches you. The whole ritual rests on the person behind the machine narrating the product faster than you can form a doubt about it. The moment a stranger leans across the counter and starts describing your coffee to you, it no longer matters how the roast was sourced. The voice has changed hands, and the voice was the business.
That is what an app notification channel actually is. Companies build it as a marketing asset and value it as one, counting open rates and conversion lifts, and they rarely price what it is underneath, which is the one line into a customer’s pocket that the customer has agreed in advance to believe. It carries the brand’s authority without the brand’s deliberation. Email gets filtered and doubted. A push alert gets read as official by default, because that is the arrangement the customer consented to when they installed the thing. Hand that channel to someone else for twenty minutes and you have not lost a database. You have lost the ability to be the first person your own customer hears from.
The security question will resolve itself in the usual way: forensics, a statement, a regulator’s letter, a line in next year’s annual report under operational risk. The communications question is the one that compounds. Every breach now runs on two clocks. The first is technical, and it is slow by necessity, because confirming what left the building takes real work and saying it early and wrongly is its own catastrophe. The second clock is reputational, and it started the instant the customer’s phone buzzed. Legal teams rehearse for the first clock exhaustively. Almost nobody rehearses for the second, which is why so many retailers discover on the day that they have no sanctioned way to say “we have seen this, we do not yet know, here is what we are doing by the hour” without a committee signing it first.
The firms that come out of this era with their audiences intact will be the ones that treat an incident as a conversation rather than a disclosure event. That means pre-written honesty, approved in advance, with blanks where the facts go. It means accepting that silence is not neutral and never has been, because a customer staring at a warning will fill the quiet with whatever is nearest, and what is nearest is the attacker’s version.
Asos sells clothes to people who have never met it, on the strength of being believed. That is the whole machine. Somebody else got hold of the microphone, and the microphone turned out to be the inventory.
Source: The Guardian, “Asos investigates after customers receive app notification claiming data breach”
