Retailers need a plan for when their own customer channels can’t be trusted, says Northdoor
Customer messaging, supplier risk and system outages belong in the incident response plan as well as technical defences, says Northdoor’s AJ Thompson.
Retailers should plan for the possibility that their normal systems and customer channels will be unavailable or cannot be trusted, says AJ Thompson, chief commercial officer at Northdoor plc. He points to the incident at ASOS, where customers received an unauthorised alert through the retailer’s own app, as a clear example of why communication has to be part of the response.
The advice follows a run of cyber security incidents at well-known fashion retailers this month. On 6 October, ASOS customers received an unauthorised “ASOS hacked” notification through the retailer’s app. ASOS has since said an unauthorised party obtained an employee’s login details by impersonating a trusted contact, then used them to access third-party platforms the company uses to communicate with customers. It said the information accessed included names, contact details and some non-personal account information, and that payment card information and account passwords were not accessed.
On 11 October, TFG London identified a cyber security incident affecting IT systems at Phase Eight, Hobbs and Whistles. In its statement on 13 October, it said several systems remained unavailable and that it was still establishing whether any personal information was compromised. H&M has said it is investigating online claims of a potential cyber security incident, but so far has no indication that its data environment has been compromised.
While the circumstances and confirmed impact of each incident differ, together they show how much is at stake for customer data, online services and brand reputation. Thompson says retailers should treat cyber security as a fundamental business priority, combining robust technical protection with tested recovery plans and, critically, effective communication with customers, employees and other stakeholders.
“Even where the full impact is still being investigated, the business must manage the immediate operational and reputational consequences. ASOS provides an important example of the communications challenge. When customers receive an unexpected and alarming notification through a retailer’s own app, the usual boundaries between a technical security incident and customer experience disappear. People want to know whether their information is safe, whether the message is genuine and what they should do next,” said AJ Thompson.
“Communication cannot be an afterthought. Retailers need to be able to explain what is known, what remains under investigation and what action is being taken, without speculating or offering assurances that cannot yet be substantiated. A carefully managed response can help customers make informed decisions and reduce the opportunity for criminals to exploit confusion through follow-on scams. This should all be part of a business’s continuity plan,” said Thompson.
“Good communication must be supported by the right foundations. Security controls must extend to suppliers and connected platforms, because an organisation’s exposure does not stop at the boundaries of its own network,” Thompson added.
“Retailers also need to plan for the possibility that their normal systems will be unavailable. That means having tested incident response and recovery arrangements, clear decision-making responsibilities and alternative ways to communicate with customers if standard channels cannot be trusted,” said Thompson.
“No organisation can promise that it will never experience a cyber-attack. The priority is to make attacks harder to execute, identify them earlier, contain their impact and recover with as little disruption as possible. Retailers that combine preventative security with operational resilience and effective communication will be better positioned to protect their customers and maintain confidence when an incident occurs,” Thompson concluded.