Recent incidents involving ASOS, Revolut and even an AI agent accessing a government portal show how attackers are exploiting trusted systems, convincing requests and emerging technology to get what they want.
Here, Sarah Coles looks at what happened and shares her key takeaways on how you can protect your firm and your clients.
ASOS customers receive a “hacked” alert through the retailer’s own app [1]
Imagine your phone buzzing with a notification from a shop you trust, telling you it’s been hacked. That’s exactly what happened to ASOS customers this month, when an alert titled “Asos hacked” appeared through the retailer’s mobile app, directing them to a Telegram account. The message claimed the attackers had fully compromised the company’s Snowflake instance (a cloud platform many large companies use to store data).
ASOS has since confirmed that third-party platforms it uses to communicate with customers were accessed without authorisation. Names, addresses, phone numbers, emails, customer numbers and dates of birth are now in the hands of criminals. The company says payment card details and account passwords were not affected.
Key takeaway
Attackers don’t always need access to your core systems. The tools you use to talk to clients, such as email marketing platforms, text messaging services or client portals, are just as valuable because they let a criminal send messages that appear to come from you.
Check who has admin access to these platforms, remove accounts that are no longer needed and make sure multi-factor authentication (MFA) is switched on for every login.
Snowflake has been linked to several high-profile breaches in recent years, including the 2024 Ticketmaster attack, where stolen credentials and a lack of MFA played a key role. You can enable MFA on your Parmenion account by downloading the Parmenion app. Find out more here: How to turn on MFA | Parmenion.
It’s also worth thinking about how you’d warn your clients if your own email or messaging account was compromised. Knowing in advance whether you’d phone, write or post on your website saves precious time on the day.
Revolut hands over customer data to criminals posing as police [2]
This case highlights just how convincing social engineering attacks have become.
Criminals gained access to an Italian government email system and used it to pose as law enforcement. Over several months, they submitted requests for information on specific Revolut customers. At least 680 customer accounts are thought to be affected. Documents shown by the hackers appeared to include driving licences, passports, identity photos used for “know your customer” checks, and transaction histories.
The hackers told the Financial Times it used blockchain analysis to find customers with large cryptocurrency holdings. It then threatened to sell the records unless Revolut paid $3 million within 24 hours. Revolut says its own systems and customer funds were not compromised, and that it blocked the address once it discovered the fraud.
Key takeaway
Advisers regularly receive requests for client information from solicitors, other providers, HMRC and the police.
The key lesson here is simple: a request from a genuine email domain isn’t necessarily a genuine request, because the account itself may have been taken over.
Every firm should have a documented process for handling third-party data requests. That includes confirming each request by contacting the organisation with contact details you’ve found independently, checking there’s a legal basis, and sharing only information that’s needed.
Remember, disclosing client data to the wrong person is a personal data breach, which may need reporting to the Information Commissioner’s Office (ICO) within 72 hours.
AI agent gains access to an Australian government portal [3]
In what’s believed to be one of the first publicly reported cases of an AI-led hack of a government website, Australia’s Prime Minister revealed that an OpenAI agent had bypassed restrictions on a Medicare statistics portal. It happened on 18 June while OpenAI was carrying out research involving Australian public medical spending, and authorities have no evidence that individual Medicare records or other personal information were accessed. The agent did reach non-public aggregate health statistics and internal file names.
What drew the most criticism was the delay. OpenAI spotted the incident on 11 August during a review of “misaligned” model activity. But the government agency, Services Australia, didn’t hear about it until 10 September, and only through a public inbox rather than a dedicated security channel.
Key takeaway
More firms are starting to use AI tools that can act on their behalf, reading inboxes, updating CRM records or searching the web. Before switching one on, understand what it can access, give it only the permissions it needs, and keep a person reviewing what it does.
This story is also a good prompt to check how your suppliers would tell you about an incident. Make sure contracts set out how quickly they’ll notify you and who they’ll contact. Have a monitored security contact too, so an important email doesn’t land in an inbox nobody checks.
Final thought
These three incidents may look very different, but they all have one thing in common.
The attackers didn't target the obvious weak spot. Instead, they exploited a trusted messaging platform, a convincing request, and a technology that was allowed to do more than intended.
That's why cyber security isn't just about protecting the front door. It's about understanding every route into your business and making sure each one is properly secured.
References:
[1] ASOS – https://www.bbc.co.uk/news/articles/c3zxjdw5ywgpo
[3] Australian government – https://www.bbc.co.uk/news/articles/c6vgy0333dppo
This article is for financial professionals only. Any information contained within is of a general nature and should not be construed as a form of personal recommendation or financial advice. Nor is the information to be considered an offer or solicitation to deal in any financial instrument or to engage in any investment service or activity.
Parmenion accepts no duty of care or liability for loss arising from any person acting, or refraining from acting, as a result of any information contained within this article. All investment carries risk. The value of investments, and the income from them, can go down as well as up and investors may get back less than they put in. Past performance is not a reliable indicator of future returns.
