On 6 October, ASOS customers opened their app to a message from the attacker. It came through ASOS’s own notification channel, in the company’s own voice.

There was no zero-day and no malware campaign. ASOS says an attacker posed as a trusted contact, talked an employee out of their credentials, and used them to get into third-party platforms that hold customer data. One identity became a broadcast channel to millions and a hit to the share price.

Join OccupyTheWeb and Anders Askåsen as they break down what happened and what it says about how breaches work today. Attackers don’t need to break in when they can log in. Third-party SaaS spreads access across systems that security teams can’t fully see. Most organizations can’t answer a simple question: who has the power to speak to every customer? We’ll look at ASOS through a cybersecurity and identity security lens, and at what it means for how you protect, monitor and govern identities.

Your attack surface isn’t your perimeter. It’s every identity that can act in your name.