[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"blog-post-asos-push-notification-lock-down-shop-messaging-tools":3},{"slug":4,"title":5,"body":6,"summary":7,"tags":8,"author":14,"cover_url":15,"published_at":16,"seo_title":17,"seo_description":18,"reading_minutes":19,"related":20},"asos-push-notification-lock-down-shop-messaging-tools","ASOS's hijacked app notification: locking down the email, SMS and push tools that can message your customers before Black Friday","\u003Cp>On 6 October, ASOS app users got a push notification the retailer never sent. A group calling itself \"Xuanye Group\" claimed to have stolen customer data and told people to contact it on Telegram. ASOS has since explained how it happened: an unauthorised party gained access to an employee account by impersonating a trusted contact to obtain login credentials, and those credentials were then used to access information on certain third-party platforms ASOS uses.\u003C\u002Fp>\n\u003Cfigure data-post-media=\"6acb19c1dbaf8c2bc523d36f\">\u003Cvideo src=\"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fasyncshop\u002Fmediagen\u002F6a\u002F6acb19c2dbaf8c2bc523d375-0-26e5ac98.mp4\" autoplay muted loop playsinline preload=\"metadata\">\u003C\u002Fvideo>\u003C\u002Ffigure>\n\u003Cfigure data-post-media=\"6acb1370dbaf8c2bc523d18d\">\u003Cimg src=\"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fasyncshop\u002Fmediagen\u002F6a\u002F6acb1370dbaf8c2bc523d192-0-7f6f389a.png\" alt=\"Securing your communication channels prevents unauthorized access.\" loading=\"lazy\">\u003Cfigcaption>Securing your communication channels prevents unauthorized access.\u003C\u002Ffigcaption>\u003C\u002Ffigure>\n\u003Cp>According to ASOS, names, contact details and some account information may have been accessed; payment card details and account passwords were not affected, and the website and app stayed safe to use. ASOS locked the affected platforms and brought in external experts, law enforcement and regulators.\u003C\u002Fp>\n\u003Cp>The part worth a small shop's attention is not the size of ASOS. It is the route: one person's login to a \u003Cem>messaging tool\u003C\u002Fem> was enough to put words in front of every customer, under the brand's name. As CX Today put it, a compromise of a communications platform can create a phishing opportunity even when core services are fine.\u003C\u002Fp>\n\u003Cp>You almost certainly have the same kind of tools: an email newsletter platform, maybe SMS marketing, maybe app or browser push, and abandoned-cart or review-request automations. Each one can message your whole customer list. Here is how to lock them down in an afternoon, before the busiest weeks of the year.\u003C\u002Fp>\n\n\u003Ch2>1. List every tool that can message customers\u003C\u002Fh2>\n\u003Cp>Write them down in one place. Include the obvious ones and the forgotten ones:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>newsletter and email marketing;\u003C\u002Fli>\n\u003Cli>SMS and WhatsApp marketing;\u003C\u002Fli>\n\u003Cli>push notifications (app or web);\u003C\u002Fli>\n\u003Cli>your shop platform's own customer emails (order notifications are templates someone can edit);\u003C\u002Fli>\n\u003Cli>review-request, loyalty and abandoned-cart apps;\u003C\u002Fli>\n\u003Cli>helpdesk or chat tools that can send outbound messages.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>For each, note who pays for it and which email address owns the account. An account owned by a former employee's personal address is a problem waiting to happen.\u003C\u002Fp>\n\n\u003Ch2>2. Who has a login\u003C\u002Fh2>\n\u003Cp>Open the users or team page of each tool and compare it with who actually works with you today.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Remove leavers, past freelancers and agencies you no longer use.\u003C\u002Fli>\n\u003Cli>No shared logins. Each person gets their own, so you can remove one person without changing everyone's password, and the activity log shows who did what.\u003C\u002Fli>\n\u003Cli>Lower roles where the tool allows it. Someone who designs emails does not need to be able to send to the full list, export contacts or add users.\u003C\u002Fli>\n\u003Cli>Keep at least two owners\u002Fadmins, so you are not locked out if one account is lost.\u003C\u002Fli>\n\u003C\u002Ful>\n\n\u003Ch2>3. Two-factor everywhere, and the right kind\u003C\u002Fh2>\n\u003Cp>Turn on two-factor authentication for every person on every tool on the list, and on the email accounts that can reset those logins. Prefer an authenticator app or a passkey to SMS codes where the tool offers them. If a tool lets the owner require 2FA for all users, switch that on.\u003C\u002Fp>\n\u003Cfigure data-post-media=\"6acb1370dbaf8c2bc523d197\">\u003Cimg src=\"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fasyncshop\u002Fmediagen\u002F6a\u002F6acb1370dbaf8c2bc523d19c-0-f9ca5133.png\" alt=\"Authenticator apps provide a stronger layer of security than SMS codes.\" loading=\"lazy\">\u003Cfigcaption>Authenticator apps provide a stronger layer of security than SMS codes.\u003C\u002Ffigcaption>\u003C\u002Ffigure>\n\u003Cp>2FA would not stop every version of what happened at ASOS: impersonation attacks often aim to trick someone into handing over a code too. That is why the next two steps matter.\u003C\u002Fp>\n\n\u003Ch2>4. Slow down a mass send\u003C\u002Fh2>\n\u003Cp>A message to your whole list should not be one click away for every account. Look for, and turn on, whatever your tools offer:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>an approval step before a campaign goes to the full list;\u003C\u002Fli>\n\u003Cli>limits on who may send, as opposed to who may draft;\u003C\u002Fli>\n\u003Cli>notifications to the owner when a campaign is sent or a new user is added.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Not every small-business plan has approvals. If yours does not, the minimum is to make sure only one or two people hold a sending role, and that the owner gets an email for every send.\u003C\u002Fp>\n\n\u003Ch2>5. Agree how you check \"urgent\" requests\u003C\u002Fh2>\n\u003Cp>ASOS's attacker succeeded by impersonating a trusted contact. In a small shop, that might be a message that looks like it comes from your platform's support, your agency or you, asking someone to log in somewhere or share a code \"to fix an urgent problem before the sale\".\u003C\u002Fp>\n\u003Cp>The rule to agree with everyone: no one shares a login code or password over chat, email or phone, ever, and any unusual request to log in is checked by calling the person back on a number you already have. Write it in one sentence and send it to the team this week.\u003C\u002Fp>\n\n\u003Ch2>6. Have the customer message ready\u003C\u002Fh2>\n\u003Cp>If a rogue message goes out, the first hour matters. Draft this now, while you are calm:\u003C\u002Fp>\n\u003Cfigure data-post-media=\"6acb1370dbaf8c2bc523d1a1\">\u003Cimg src=\"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fasyncshop\u002Fmediagen\u002F6a\u002F6acb1370dbaf8c2bc523d1a6-0-abadb78d.png\" alt=\"Having a plan to quickly stop rogue messages can limit damage.\" loading=\"lazy\">\u003Cfigcaption>Having a plan to quickly stop rogue messages can limit damage.\u003C\u002Ffigcaption>\u003C\u002Ffigure>\n\u003Col>\n\u003Cli>\u003Cstrong>Stop it.\u003C\u002Fstrong> Who logs in and pauses campaigns, removes the compromised user and resets passwords. Write the steps for each tool.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Tell customers\u003C\u002Fstrong> on a channel the attacker does not control (your website banner, your social accounts, a message from a clean tool): what was sent, that it was not from you, not to click links or reply, and what you are doing.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Get help.\u003C\u002Fstrong> Tell the tool's provider. If customer data may have been accessed, check your obligations: in the UK and EU, a personal-data breach may have to be reported to the data-protection regulator, and fast.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Cp>A short template is enough:\u003C\u002Fp>\n\u003Cblockquote>\u003Cp>Earlier today some customers received a [message\u002Femail\u002Fnotification] that did not come from us. Please do not click its links or reply to it. We have stopped it and are investigating. We will never ask you for your password or payment details by message. We will update this page as we learn more.\u003C\u002Fp>\u003C\u002Fblockquote>\n\u003Cp>Note how ASOS framed its own message: what was and was not affected (no payment details, no passwords) and that the site was safe to use. Customers want exactly those two answers first.\u003C\u002Fp>\n\n\u003Ch2>The afternoon, summed up\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>A list of every tool that can message customers, and who owns each account.\u003C\u002Fli>\n\u003Cli>Leavers removed, no shared logins, sending rights for one or two people.\u003C\u002Fli>\n\u003Cli>2FA required for everyone, including the inboxes that reset those logins.\u003C\u002Fli>\n\u003Cli>Approvals or send notifications switched on where the tool has them.\u003C\u002Fli>\n\u003Cli>A one-line \"we never share codes\" rule, and a ready-to-post customer message.\u003C\u002Fli>\n\u003C\u002Ful>\n\n\u003Ch2>Sources\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fasos-links-data-breach-to-social-engineering-attack-credential-theft\u002F\">BleepingComputer: ASOS links data breach to social engineering attack, credential theft\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fcxtoday.com\u002Fwhat-asos-ai-agents-and-400-vulnerabilities-reveal-about-cx-risk\">CX Today: What ASOS, AI agents and 400 vulnerabilities reveal about CX risk\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>","Attackers got an ASOS employee's login by posing as a trusted contact, then used it on third-party platforms to push a message to customers. A small shop has the same exposure in its newsletter, SMS and push tools. An afternoon checklist, and the message to have ready.",[9,10,11,12,13],"security","email-marketing","black-friday","small-business","ai-assisted","Async.Shop","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fasyncshop\u002Fmediagen\u002F6a\u002F6acb136fdbaf8c2bc523d17e-0-a59f8366.png","2026-10-11T07:32:22.052Z","Lock down your shop's email, SMS and push tools (ASOS lesson)","ASOS's rogue push notice came through a stolen employee login on third-party tools. An afternoon checklist for a small shop, plus a ready customer message.",5,[21,33,43],{"slug":22,"title":23,"type":24,"summary":25,"tags":26,"author":14,"cover_url":30,"published_at":31,"updated_at":32},"shop-your-own-store-like-an-ai-agent-pre-black-friday-test-script","Shop your own store the way an AI agent would: a pre-Black-Friday test script","blog","Ask ChatGPT, Claude and Copilot your customers' top questions about your shop, log every wrong or missing answer, and fix the source before Black Friday.",[27,28,29,11,13],"ecommerce","shopify","ai-agents","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fasyncshop\u002Fmediagen\u002F6a\u002F6ae48cd437fa83c1536d8c1a-0-09c57ab4.png","2026-10-31T04:02:11.962Z","2026-10-31T04:02:11.963Z",{"slug":34,"title":35,"type":24,"summary":36,"tags":37,"author":14,"cover_url":41,"published_at":42,"updated_at":42},"shopify-mcp-servers-shopper-ai-what-to-check","What Shopify's MCP servers let a shopper's AI do in your store, and what to check first","Shopify's docs now split what a shopper's AI assistant can do in your store across several servers. A plain-language map of what each exposes, what the docs leave unsaid, and which policy pages to tidy before an assistant reads them aloud.",[28,38,39,40,13],"ai-shopping-agents","mcp","store-policies","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fasyncshop\u002Fmediagen\u002F6a\u002F6ae1ba761edd7a39ec513077-0-3172c55c.png","2026-10-29T03:19:16.591Z",{"slug":44,"title":45,"type":24,"summary":46,"tags":47,"author":14,"cover_url":52,"published_at":53,"updated_at":54},"etsy-bans-ai-patterns-recipes-what-sellers-must-change","Etsy now bans AI-made patterns, recipes and instructions: what pattern and printable sellers must change, and what AI use is still allowed","On 22 October Etsy banned AI-generated patterns, recipes and instructions, banned bot-made listings and asked for one unedited photo of the real item. A checklist for pattern, recipe and printable sellers: what is at risk, what to fix first, and what AI use is still fine.",[48,49,50,51,13],"etsy","marketplace-policy","digital-products","product-photos","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fasyncshop\u002Fmediagen\u002F6a\u002F6ae038cf1edd7a39ec50fa8a-0-03819514.png","2026-10-27T07:25:13.068Z","2026-10-27T07:25:13.069Z"]