Everywhen warns cyberattacks can breach customer trust

Everywhen has warned that cyberattacks compromising customer communications can create risks that insurance may not fully cover. The warning follows unauthorised messages sent to ASOS customers through the retailer's app.

The episode shows how a cyber incident can extend beyond stolen data or disrupted systems and undermine trust in routine notifications, emails and messages from familiar brands. For businesses, that creates a separate set of issues, including reputational damage, fraud prevention and the cost of handling customer concerns after systems have been restored.

ASOS customers received an unauthorised notification through the retailer's app saying the company had been hacked. The retailer later said it was investigating unauthorised activity involving third-party communication platforms.

An initial investigation found that some customer names and contact details had been accessed, but payment card information and account passwords were not affected. ASOS said its website and app remained operational.

Everywhen said the case highlighted a broader question for companies that rely on digital channels to reach customers: if a message appears to come from a trusted organisation but the channel itself has been compromised, customers may struggle to tell what is genuine.

Neil D'Mello, Client Director, South Division, at Everywhen, said the issue should feature more clearly in cyber risk planning. Companies often focus on data breaches, ransomware, system recovery and business interruption, while giving less attention to the consequences of compromised customer communications, he said.

"A cyberattack can do more than steal information or shut down a company's systems. It can potentially allow criminals to speak directly to customers through the very channels they have been taught to trust. This highlights the growing importance of customer communications in cyber risk management, particularly after the incident involving online fashion retailer ASOS last month," said Neil D'Mello, Client Director, South Division, at Everywhen.

Trust issue

The concern is especially acute for businesses that use outside providers for messaging tools, payment services, marketing systems and other customer-facing operations. In those cases, a security problem may emerge through a third-party platform rather than the company's own core systems.

Businesses should examine who has access to those systems, how controls are managed and what procedures are in place if a communication channel is no longer reliable, Everywhen said. It said this should form part of a wider cyber risk assessment rather than sit only within technical recovery planning.

D'Mello said the effects of an incident can continue even after the immediate technical problem has been contained.

"One of the most concerning aspects of a cyber incident is the possibility that criminals can exploit the relationship of trust between a business and its customers. Customers are accustomed to receiving notifications, emails and messages from organisations they deal with every day. If those channels are compromised, people may have difficulty distinguishing a genuine communication from a fraudulent one.

"Even when a business restores its systems quickly, rebuilding confidence can present a different challenge. The technical incident may be contained, but the questions from customers can continue," he said.

Insurance limits

Everywhen also pointed to the limits of insurance cover in this area. Cyber policies may give policyholders access to incident response specialists, forensic investigators, legal advisers and crisis communications support, depending on the terms of the cover.

But not all consequences of reputational harm or reduced customer confidence will necessarily be insured, it said. That leaves companies to consider not only how they would recover systems and investigate a breach, but also how they would reassure customers if ordinary contact channels could no longer be trusted.

The issue comes as businesses face a changing threat environment shaped in part by artificial intelligence. Everywhen said AI can help identify threats earlier and assist with recovery after an incident, but it can also be used by threat actors to make attacks more convincing and easier to carry out at scale.

Rather than creating an entirely separate category of risk, AI is increasing the speed, scale and sophistication of existing cyber threats, the insurer said. That adds to the pressure on organisations to make customer communications as resilient as their internal systems.

D'Mello said companies should settle key questions before any attack, including how warnings would be issued and how customers would be able to verify them.

"Businesses need to consider not only how they would respond to a cyberattack, but how they would communicate with customers if their normal channels could no longer be trusted.

"Who would issue the warning? How would customers verify it was genuine? And could the business respond quickly enough to limit the potential for further harm? These are questions that should be answered before an incident occurs, not during one," he said.