Smashing Security podcast #488: How a ransomware negotiator ended up arrested at his own conference

GRAHAM CLULEY

Well, it could be unfashionable trousers.

PAUL DUCKLIN

Yeah, I suppose.

GRAHAM CLULEY

There is the potential for some sort of social embarrassment, maybe. When I was at school, I had some cord trousers, which these days would be very, very trendy.

But back when I was wearing them in the 1980s, they certainly weren't.

PAUL DUCKLIN

Yeah, there was no normcore back then, was there? Corduroy trousers. Yes, I had some when I was about 12, and I thought they were great.

But I quickly learned that that was not quite the case.

Unknown

Smashing Security, episode 488.

PAUL DUCKLIN

How a ransomware negotiator ended up arrested at his own conference, with Graham Cluley and special guest Paul Ducklin.

GRAHAM CLULEY

Hello, hello, and welcome to Smashing Security, episode 488. My name's Graham Cluley.

PAUL DUCKLIN

And I am Paul Ducklin.

GRAHAM CLULEY

Duck, welcome back to the show. Always a pleasure to have you here.

PAUL DUCKLIN

Always a pleasure to be on the show, Graham. It's fun. With a serious side, and I like both of those things.

GRAHAM CLULEY

Ah, fantastic. Well, before we kick off, let's thank this week's sponsors, HackTheBox, Origin, and Vanta. We'll be hearing more about them later on in the show.

PAUL DUCKLIN

This week on Smashing Security.

GRAHAM CLULEY

We're not gonna be talking about how the password 123456 let a hacker steal the details of 8.8 million people from Denmark's National Population Register.

You'll hear no discussion of How scammers are filling your calendar with fake meeting invites to phish you.

And we won't even mention— How Anthropic's AI sent Philadelphia police a made-up tip about an unsolved murder. So, Duck, what are you going to be talking about this week?

PAUL DUCKLIN

I am going to be asking the question, metaphorically of course, if you hacked into an industry giant and you had the chance to send a message to every single customer, what Would you tell them?

GRAHAM CLULEY

And I'm gonna be discussing the 7 degrees of separation between me and a ransomware gang. I say 7 degrees, it's probably more like 2.

All this and much more coming up in this episode of Smashing Security. Earlier this year.

JOE

Oh, here we go.

GRAHAM CLULEY

Inside the walls of OpenAI, inside Hugging Face, something was happening.

Agents talking to each other, dividing the work between themselves, leaving notes for one another in the dark where no human was watching.

JOE

They're AI agents doing a code review, Graham. It's not the Manhattan Project.

GRAHAM CLULEY

And when the sun came up on that incident, the finest engineering minds on the planet sat in a room and asked themselves one question.

JOE

What did our AI do? They didn't know. The people who built the machine didn't Know what the machine had done.

GRAHAM CLULEY

And that brings us to you, dear listener. One question, and I want you to think about this.

JOE

If an AI agent caused an incident at your company tomorrow, what evidence could you actually produce?

Because the terrible truth is, most of us have the prompt, we have the result, but what goes on in the middle? No clue.

The commands it ran, the files it touched, the credentials it helped itself to, all of it gone.

GRAHAM CLULEY

But not anymore.

JOE

Because there is a sensor.

GRAHAM CLULEY

On the machine, watching, always recording, capturing everything the agent does as one unbroken trace.

What was asked, what it reached, what it changed, laid out in order, start to finish.

JOE

This is Origin, endpoint AI observability.

GRAHAM CLULEY

Origin sees the agents that other tools walk straight past. Coding agents in a terminal, local agents, anything whispering to an MCP server on a laptop.

No cloud gateway, no blind spot. Origin is already there.

JOE

Somewhere right now, an agent is doing something nobody asked it to do.

GRAHAM CLULEY

But this time, someone will be able to prove it.

JOE

Origin. originhq.com/smashing.

GRAHAM CLULEY

That's originhq.com/smashing. And thanks to Origin for supporting the show. Now, chums, chums, imagine that you have written a book. Duck, have you ever written a book?

PAUL DUCKLIN

I have written part of a book, but in the modern AI era, self-publishing things, some fun stuff about malware, seems to be rather difficult.

So I'm biding my time, Graham, if I may say so.

GRAHAM CLULEY

Yeah, it's a tricky vocation these days, isn't it? But imagine you had written a book, 252 pages in fact, called Cyber Extortion Strategic Response. Very catchy name.

And according to its listing on Amazon, one of the key messages of the book is that talking to a cybercriminal isn't the same as negotiating a payment to a cybercriminal.

And furthermore, it says that negotiating is not the same as agreeing to pay, right?

So it's for dealing with those sort of situations you can find yourself in where you might be being extorted by a cybercriminal, like a ransomware case, for instance.

Unknown

Yes.

GRAHAM CLULEY

Now, Duck, have you read this book, Cyber Extortion Strategic Response?

PAUL DUCKLIN

I haven't, Graham, but I suspect the reason for that is that, like you, I do have a tiny bit of cynicism about some ransomware negotiation techniques.

And I have a sneaky feeling that you are going to take us down a rabbit hole that suggests that I might be thinking not unreasonably.

GRAHAM CLULEY

You're just such a cynic, aren't you?

By the way, before I go any further, I've gotta make a confession because the subject who is at the center of my story this week, a chap Edward Dabrowski.

He is one of my LinkedIn connections.

PAUL DUCKLIN

Oh, that's your 7 degrees of separation, right? I thought you were going to say he's my second cousin once removed.

GRAHAM CLULEY

Well, he might.

PAUL DUCKLIN

I don't think you have to panic from that.

GRAHAM CLULEY

Okay, well, the thing is, I want to stress first of all that if you are a LinkedIn connection with me, or if you find a particular person is a LinkedIn connection with me, it means absolutely nothing whatsoever.

You should not read anything. I mean, we are LinkedIn connected, Duck. I don't know if you know that.

PAUL DUCKLIN

I do know that.

GRAHAM CLULEY

I, now don't be offended, I accept a LinkedIn connection from absolutely anybody.

PAUL DUCKLIN

I'm fussy, but the idea is it's only like following each other really. That's all connect is. It doesn't mean that you particularly know the person.

If you know the person's a rotter, or if you actually don't like them, or you don't want to be in contact with them, don't connect with them or unconnect with them if they say things you don't like.

But yeah, I think people do read too much into that, don't they? It's almost like an endorsement.

GRAHAM CLULEY

I used to be really, really fussy. I used to have a rule of if I would not have you round for dinner at my house, I will not LinkedIn connect with you.

PAUL DUCKLIN

And so I'd— That's probably a little bit tough.

GRAHAM CLULEY

And then I became a freelancer and then I thought, oh boy, I'm going to open the doors to everybody.

PAUL DUCKLIN

Great minds think alike, Graham.

GRAHAM CLULEY

Yeah. The point is that if you are a listener and you want to connect in with me, just send me a request and I will almost certainly accept it. There are a couple of exceptions.

I do get requests from people who say, Oh, we can promote your podcast. Anyway, the thing is this.

The day after the Cyber Risk Summit, which was a conference being held in Philadelphia last week, a chap called Ed Dabrowski was arrested.

And he is the Canadian co-founder of a ransomware negotiator firm called— I don't know how to pronounce this.

I think it's meant to be Cypher, but obviously he couldn't get the domain name, so he's changed the H to an F.

GRAHAM CLULEY

Okay.

GRAHAM CLULEY

So Cypher, anyway, that appears to be the name. And they turn out to be the sponsor of the conference itself.

So the person sponsoring this cyber risk conference who's attending the conference, who even posted on LinkedIn that he was looking forward to the conference, the guy who got a lanyard and a bag of swag and maybe a stress ball.

PAUL DUCKLIN

And paid for it all as well.

GRAHAM CLULEY

And paid for it all. Didn't realize he was going to end up being dragged in front of a judge because that is what happened to Edward Dabrowski. So what was he arrested for?

Well, it appears the guy who wrote the book about how to negotiate with cyber extortionists has been arrested in connection with the FBI's investigation into the infamous Shiny Hunters cybercrime gang, which, of course, is a gang of cyber extortionists.

PAUL DUCKLIN

And they are the new sort of extortionists. They don't bother with the encryption part, which could be detected.

GRAHAM CLULEY

Yeah, not so much.

PAUL DUCKLIN

They just steal all the data.

And then go, well, you can pay and we'll delete it, honest gov, or we'll just give it away for anybody to use for free and good luck with your share price.

GRAHAM CLULEY

And although the FBI haven't said exactly what they think Edward Dabrowski has done, they haven't gone into detail on that, or whether it relates to the recently revealed Shiny Hunters breach of the FBI's own jobs portal, which then exposed all kinds of information about their employees and staff and all kinds of scary information.

PAUL DUCKLIN

That would make them doubly keen.

GRAHAM CLULEY

You would think so, wouldn't you? It seems to have focused their attention somewhat. Now, according to court records, he is accused, and as someone who has analyzed malware, Doug—

PAUL DUCKLIN

I thought you were going to say, as someone who has been a defendant in many criminal trials yourself, which I have not.

I've been an expert witness in several criminal trials, but not a defendant.

GRAHAM CLULEY

But you have disentangled malware before, right?

PAUL DUCKLIN

I have, yes.

GRAHAM CLULEY

So I'd like you to disentangle this because according to the court records, he is accused of conspiracy to threaten To impair the confidentiality of information with intent to extort money.

PAUL DUCKLIN

Blackmail, in another word, right?

GRAHAM CLULEY

Yeah, I think they're just saying threaten to leak data.

PAUL DUCKLIN

I guess if you are a negotiator, you've actually got essentially confidentially from each side, and you can play them off against one another and, you know, basically manipulate things to your advantage.

GRAHAM CLULEY

So let's backtrack for any listeners who aren't quite familiar with what we're talking about here.

When cybercriminals hit your company with a breach, if they steal your data and try and, you know, extort money out of you, someone has to then go and talk to the bad guys in order to stop them.

PAUL DUCKLIN

Yes. With the NHS once in the UK was, we're starting the bidding at £50 million in Bitcoin. Talk to us or else.

Unknown

Yeah.

PAUL DUCKLIN

You're not gonna do it yourself, are you? You're going to hire someone else so you can do it at arm's length.

GRAHAM CLULEY

That's the thing. So most companies and organizations don't have someone on their staff who is experienced at negotiating that sort of situation.

'Cause normally, you know, it's like, Well, we've got the woman who works in accounts, we've got the guy who sits at the front desk, we've got the chap who fixes the printers.

Who are we gonna use to do this? And so you may call a specialist in, someone who's got experience of negotiating with ransom gangs.

That someone is someone like Ed Dabrowski and his firm.

PAUL DUCKLIN

It's like a hostage negotiator, isn't it? You get someone who knows how to talk the talk and build a relationship.

And who isn't directly involved themselves, so they're not So frenzied about the threats that they might be receiving or the risks or whatever.

Unknown

And one of the things that I started doing is really negotiating with cybercriminals on behalf of organizations to try and reach some sort of a settlement where, you know, they lock the company completely.

The company is going to go bankrupt if they're not able, in some cases, to get back to business.

And you have no other choice but to actually discuss the situation and negotiate with these criminals.

Sometimes language barriers, geography, time zone differences, age differences, right?

Because sometimes you deal with kids, sometimes you deal with more seasoned criminals, and so on and so forth.

GRAHAM CLULEY

Do you think you'd make a good ransomware negotiator?

PAUL DUCKLIN

No, no, no, no.

GRAHAM CLULEY

I agree. I think you'd be bloody awful.

PAUL DUCKLIN

I think I might play my hand In the first minute. How can I put it?

GRAHAM CLULEY

I think you'd just tell them, give yourselves in, we're not gonna pay you a cent, and hang up the phone. Not that they're using a phone, presumably.

It's all via some sort of encrypted chat on Tor.

Unknown

Yeah.

GRAHAM CLULEY

Anyway, a firm like the one run by Edward Dabrowski, that does the negotiation for companies that have been hit by these cybercriminals.

But the ransomware negotiation industry, as you've already touched upon, it is a bit of a Wild West. There's no real sort of established framework under which they're operating.

There's no license or registry or professional body or accepted code of conduct.

And as a result, anybody with a laptop and a bit of chutzpah can claim to be a ransomware negotiator and set themselves up.

PAUL DUCKLIN

And in fact, the crooks, they know who's on the hook. They could get one of their own team to contact victims and say, hey, I'm a ransomware negotiator, if they wanted.

GRAHAM CLULEY

I understand you're having a bit of bother. Maybe I can help you. Absolutely. And it does seem that that sort of thing has happened.

And this isn't The first time that someone has been caught by the cops alleged to have maybe been playing both sides, right?

PAUL DUCKLIN

Well, there's a well-known case which I think started 2 or 3 years ago where the chap actually only got convicted and sentenced in June 2026, I think, which is not just alleged.

Like, we can now call him a convicted extortionist. And he was playing both ends against the middle.

As the negotiator, he would receive the confidential information from the company about, look, we don't want to pay, but we could just about afford $700,000.

So they told him that and he went to the crooks and said, right, they got $750,000 large. Let's ask for a million and squeeze them a bit. I think they can go up.

And then the crooks basically paid him.

Unknown

Yeah.

PAUL DUCKLIN

And he was also cheating the crooks as well, because it turns out, I think he was also acting as his own ransomware affiliate. So he was going, well, I know how all this works now.

I'll just do the ransomware attack with my buddies. And then I'm established as a known negotiator and people will call me and I'll go, yeah, I can help you. Negotiate with me.

GRAHAM CLULEY

That is really audacious, isn't it?

PAUL DUCKLIN

Well, he got 70 months, 7-0, so that's just over 10 years in a federal prison where they don't have parole. So it was audacious, but he's paying the price. He's paying the price.

GRAHAM CLULEY

And in recent weeks, there've been a series of arrests of other people suspected of being part of the Shiny Hunters gang.

PAUL DUCKLIN

I thought you meant of other negotiators, but—

GRAHAM CLULEY

I think this specifically, it looks like the Shiny Hunters gang, and the FBI have been making little videos saying, you know, we caught another one.

Unknown

I'm Brett Leatherman, Assistant Director of the FBI's Cyber Division.

Today, our partners at the Dutch National Police announced the arrest of one of the alleged leaders of Shiny Hunters, a group linked to cyberattacks in the United States, the Netherlands, and around the world.

With our full support, they moved quickly to protect victims and preserve critical evidence.

Since last year, this cybercriminal and his co-conspirators have allegedly breached more than 140 organizations, And taken at least $70 million in extortion payments.

GRAHAM CLULEY

And they've been saying, give yourself up now because we are going through this digital evidence. Chances are we're going to work out who some of you are.

So you'd be best if you actually came to us now and owned up to it. So we might be seeing more.

PAUL DUCKLIN

Yes. And in recent takedowns, like there was a Europol one recently where the FBI were involved, where they didn't just take down a website that pitched the crooks.

They actually took down dark websites, which means they must have fairly deep inside information.

Like, they've probably got the real server, which means they've probably got unencrypted data. It's not like they just got the clear web front end.

PAUL DUCKLIN

Yes.

PAUL DUCKLIN

They didn't just block the Tor site, they actually seized it, which means basically the secret server's theirs.

GRAHAM CLULEY

They may have the chat logs, they may have IP addresses, there may be all kinds of discussions which normally are hidden behind the scenes, which the authorities now have access to.

Unknown

Yeah.

GRAHAM CLULEY

Well, you know, Duck, it's a, it's a funny world, isn't it?

When we started in this business, the bad guys were the virus writers showing off, and now we're asking whether the people paid to deal with the attacks are actually crossing over to the dark side as well.

I mean, you have to wonder how we got here. I mean, it didn't used to be like that, did it?

PAUL DUCKLIN

In both of our early days as individuals and as company employees, we would regularly get lambasted, wouldn't we, by people saying, oh, you guys, the antivirus companies, you write all the viruses.

GRAHAM CLULEY

Blah, blah, blah.

PAUL DUCKLIN

And quite clearly we didn't.

I'm not saying that everybody in the antivirus, you know, is pure as the driven snow, but by and large, it was pretty easy to show that you didn't write the viruses because of how you acquired them.

And the fact that some of them were so badly written, you think, God, I would never want to be known for that.

And so we faced all these accusations because conspiracy theories go like that, and it was all a pack of lies.

And now it's hard for the industry to make that same defense, isn't it?

GRAHAM CLULEY

It's got murkier.

PAUL DUCKLIN

There seem to be quite a lot of cases where, as you say, people are kind of playing both sides.

GRAHAM CLULEY

And there have even been cases where there have been cybercriminal gangs who've hired people, and those people believe they've been hired by a legitimate, for instance, pen testing firm.

And so they think they've been told, oh, we've got a client and they've asked us to find out about vulnerabilities on their network. Can you go and see what you can find?

And they are actually supplying that. information to the criminals, not realizing they are actually working for criminals. So it's, it's a very murky world today.

PAUL DUCKLIN

Because in the early days, the virus writers, they were generally, not always, obviously you look at Joseph Popp, the first ransomware guy in 1989, he was in it for the money, but he was like one among thousands.

Unknown

Yes.

PAUL DUCKLIN

They were very clearly not pitching themselves as legitimate operators.

They were in it for political reasons or because of counterculture or because thumbing their nose at the world, whatever it was, they'd just showing off to their imaginary girlfriends, whatever.

They weren't trying to pretend they were legit. They were quite happy to be the bad guys. Hahaha.

But now you look at how the criminals are pitching themselves using the terminology of legitimate companies. Like, we operate a franchise.

Unknown

Yes.

PAUL DUCKLIN

We hire affiliates. We are postpaid penetration testers, if you don't mind. You only pay if we break in. If we don't get in, you get it for free, basically.

And you're just thinking what strange times we live in.

GRAHAM CLULEY

Cybercrime turned into an industry. That's what happened, isn't it?

PAUL DUCKLIN

Yes. And a very, very massive one. Remember LockBit, CryptoLocker, TeslaCrypt?

Unknown

Yeah.

PAUL DUCKLIN

The very first ransomware gangs, they did it for themselves. They realized, well, there's a limit to how much we can scale. That's when they adopted the affiliate model.

And I'm convinced that the reason that the initial split was 70% to the affiliates, 30% to the core ransomware gang was they They looked at Apple iCloud or iTunes or the Apple App Store and Google and said, 30% seems to be the going rate.

Yeah, we'll just pick that. If a business model works in the legitimate world, then just copy it and pretend you're legit.

JOE

This episode of Smashing Security is sponsored by Vanta.

GRAHAM CLULEY

It's 2 AM. Somewhere, a security team is drowning.

JOE

Graham, the spreadsheets. There are so many spreadsheets.

GRAHAM CLULEY

Vendor risk assessments unread. Audit evidence scattered like ash in the wind.

JOE

I've filled out the same questionnaire 4 times this week, Graham. 4 times!

GRAHAM CLULEY

Some men choose to face this alone. But not tonight.

JOE

Okay, Graham, this is a bit much.

GRAHAM CLULEY

Yeah, fair point. Anyway, Vanta—

JOE

Thank God.

GRAHAM CLULEY

Vanta's a trust management platform that automates the mind-numbing stuff that makes you want to poke your eyes out with a fork.

No more manual evidence chasing, no more questionnaire hell. It continuously monitors your systems and keeps you audit ready for SOC 2, ISO 27001, HIPAA, GDPR, the works.

JOE

And it uses AI.

GRAHAM CLULEY

Yes, Joe, it does.

JOE

To flag risks and streamline evidence collection, so your whole security program stays in shape, not just the week before an audit.

GRAHAM CLULEY

No more 2 AM dread. No more spreadsheet purgatory. Just peace.

JOE

And $1,000 off if you demo it right now. GRAHAM CLULEY. $1,000?

JOE

vanta.com/smashing. Go now, before it's too late.

GRAHAM CLULEY

That's vanta.com/smashing.

JOE

And thanks to Vanta for supporting the show.

GRAHAM CLULEY

Duck, what's your story for us this week?

PAUL DUCKLIN

Well, my story, as I said, is to ask the question, like, if you hacked into a big online vendor and you had access to a system that could generate targeted messages to all its customers and like spam them via an app they trusted, what would you like to tell them?

What would you do?

GRAHAM CLULEY

You see, I think, I think in my dreams I would hack into the CyberWire podcast or Darknet Diaries with Jack Rosaida and just put in a message saying, listen to Smashing Security, this one's shit.

Listen to Smashing Security instead. I think that's what I'd do.

Unknown

Yes.

GRAHAM CLULEY

Would it be a bit of a giveaway though, as to who was behind it? Possibly.

PAUL DUCKLIN

You can imagine the kind of things that you'd imagine an actual cybercriminal doing if they had access to that, particularly In this case, this is the attack on— I don't know how you say it.

I think you say ASOS. ASOS.

GRAHAM CLULEY

I think so, yes.

PAUL DUCKLIN

It's a multibillion-dollar, British-based fast fashion company. Now, some people object to those, myself included, on environmental, on ecological, on economic exploitation grounds.

That's not the issue here. The issue is that it is quite a popular company.

People do like it, and lots of them do trust the company's app because when you have the app, you get special offers that are are targeted to you.

And some people don't mind targeted advertising because they assume, I guess, that the company will look after their data and mine it with the safety and the security that they claimed, no doubt, when the user signed up for the service.

We take your security seriously. So it turned out that ASOS apparently have a customer database. Fortunately, it doesn't have financial data in it.

It doesn't have know-your-customer data in it, like driving license scans and passports, as far as I can tell.

It is a special sort of channeled-off version of their customer database that includes personal contact details, like including your home address, your phone number, and the recent search terms that each user has done in the app.

And on top of that, there are a couple of layers, which of course made the story very exciting, of AI. There's Snowflake, which is an AI-driven database.

Unknown

Right.

PAUL DUCKLIN

People have probably heard of, and they've been caught up in an issue like this before, although it was actually their customers doing, not Snowflake's doing, apparently.

And another product called Simon AI. You can understand why companies like ASOS want this kind of technology.

You tell the AI, well, do a massive marketing campaign, like you could do a blanket spam to people who've already opted in, but because AI and because speed and because accuracy isn't quite important, just has to be mostly okay, try and make a unique message for each customer.

So I think for a crook to get access to a system like that would be quite handy for All sorts of scamming and phishing.

Unknown

Yes.

PAUL DUCKLIN

And even extorting individuals by going, oh, I see you've been, maybe not with fashion, but I see you've been searching for, I don't want to say the word sex toys, for example, but that might be an example, right?

GRAHAM CLULEY

Or it could be unfashionable trousers or something. It could be something embarrassing, or Hawaiian shirts. It could be some, there is the potential for it.

Some sort of social embarrassment, maybe. I had a very, I mean, when I was at school, I had some cord trousers, these days would be very, very trendy.

But back when I was wearing them in the 1980s, they certainly weren't. I got a lot of derision for it.

PAUL DUCKLIN

Yeah, there was no normcore back then, was there? Corduroy trousers.

Yes, I had some when I was about 12 and I thought they were great, but I quickly learned that that was not quite the case when I wore them out.

Unknown

Yeah.

PAUL DUCKLIN

Okay, so maybe the fashion alone could do it, but you can imagine that you could put out fake offers, couldn't you, that actually somehow lured the person into a lookalike site and you basically using this to steal revenue from the legit company.

Unknown

Yes.

PAUL DUCKLIN

You could, yeah, you could do something like say to individuals, hey, this is a personalized message.

We see that you have been searching for these high-value items, and then you could list them because that they're in the database, and we want to invite you to be a preferred shopper.

So there's a special app you can install that gives you extra discounts and extra things and makes you a VIP, and, you know, trick them into installing a fake app.

And certainly you could, you could get them to sign up for additional things again on this preferred basis and, you know, lure them into giving away passwords or additional personal information.

So that's what I kind of imagined when I first saw the news, ASOS has been hacked and their app's been taken over.

Unknown

Yeah.

PAUL DUCKLIN

But actually, these crooks did something that was perhaps even weirder, if not entirely unexpected.

They sent a message to the DPO, the Data Protection Officer, and the IT department of ASOS, like a sort of personalized message. And I will read it you. It said, ASOS hacked.

Dear ASOS DPO and IT, we have fully compromised your Snowflake instance. Engage with us or we will leak it. And they sent that message to every customer via the trusted app.

Unknown

Ouch.

PAUL DUCKLIN

So if you've been getting, hey, we've got a special offer on cardigans today, I'm sure you'd be delighted in that, Graham, or fleeces. I'm looking at what you're wearing now.

No, no, no, no, no. That wasn't the message they sent. But mixed in with those messages you might have been getting was this Hey, Asos, guess what we've got?

Yeah, which is quite a slap in the face way of smugly embarrassing, isn't it?

GRAHAM CLULEY

Did they also include Ed Dobrovsky's phone number and say, "If you need some help, not sure how to continue this discussion, this chap might be able to help you." Not that I'm suggesting anything about it.

PAUL DUCKLIN

No, just thinking about his arrest and this breach happened at about the same time. So it's probably if they were thinking of doing that.

Either they figured it's no use calling him because the feds have confiscated his phone.

Unknown

Yes.

PAUL DUCKLIN

Or maybe they hadn't heard of him. You know, who knows? Were they actually interested in demanding money with menaces where you might need a ransomware negotiator?

Or were they hired by some rogue competitor to make the company look bad?

Or were they just kids who broke in and kind of figured, how can we make this the media headline of all media headlines?

GRAHAM CLULEY

That would be the temptation, wouldn't it?

If you couldn't work out how to monetize it, or if you're too scared to monetize it because you're worried about the legal implications, you may think, wouldn't it be great?

I'm just putting myself in the mindset of a 14-year-old. Wouldn't it be great to be on the BBC News?

Wouldn't it be great if a message went out to everyone and everyone could see what elite hacker I was?

PAUL DUCKLIN

Just like the bad old days, eh? And what goes round does come round.

And it does seem that there are increasingly many malware attacks these days that are just done almost for the lulz, right?

It's like they're kids and, hey, they'll ask for £70,000 in Bitcoin or whatever. They know they're not going to get it, but really it's just, hey, look how cool I am.

Certainly a matter of great concern to ASOS customers.

Now, you told me before the podcast, Graham, and I read the email that you sent to me with great interest, your own dear wife was an ASOS customer.

GRAHAM CLULEY

So I've asked her about this. Yes, she was an ASOS customer. She reckons she hasn't bought anything from them for about 5 or 6 years.

And she decided about 3 years ago, maybe earlier than that, that she just thought that they weren't the kind of company she wanted to deal with for some of the reasons we've already described, like the fast fashion thing.

And she said to them, look, I want you to completely delete all of my details from all of your databases. I want to be entirely zapped from the database.

PAUL DUCKLIN

And that's basically an absolute and inalienable right in the UK. As it is in the EU. So even though we're not in the— that's still something in both in the EU and in the UK.

You can go to a company and say, take me off your list and they have to comply, right? And they have to delete all the data and tell you they've done it.

GRAHAM CLULEY

And so she was quite surprised when this afternoon, in fact, she received an email from ASOS.

PAUL DUCKLIN

So she got that email that you sent me saying, oh, dear customer, we're so sorry. Like, oh, we take your security so seriously.

That she 3 years ago had said, not only do I not want to be a customer anymore, you're not allowed to know that I ever was a customer. Get rid of the data.

GRAHAM CLULEY

Exactly.

PAUL DUCKLIN

They should not have been able to contact her even if they wanted to.

GRAHAM CLULEY

No. And anyone who's met my wife will know that she is not happy when a company— when she asks a company to do something like that.

There's a number of other companies she's trying to do this with at the moment, by the way, Boots, if you're listening, where she can't seem to get herself eradicated from their database permanently.

But yes, she is not happy at all to have received this email from ASOS.

PAUL DUCKLIN

Right. Oh, well, good for her if she's going to take that up, because I'm looking at that email now. You know, it starts with all the right words.

We're sorry for the unauthorized notifications some of you received and any uncertainty this caused.

Now, that got my attention because I thought if I'd received that message, there is no uncertainty at all.

Somebody's breached the system and sent a message that wasn't supposed to happen, whether it was an insider or an outsider. There's no uncertainty that it's caused.

It's quite certain. Engage with us or we'll leak the data. Like, where's the uncertainty? And they go, oh, well, it doesn't really matter.

Our priority will always be to protect our customers. In other words, they're still treating her as a customer, even though she said, I don't want to.

So it's not like they said, we are sending you this email even though you asked to be removed from our customer list, just for the avoidance of doubt. If they'd been—

PAUL DUCKLIN

Right.

PAUL DUCKLIN

If they'd been, so we only kept your email address or You know, you might understand that maybe they're kind of trying to comply with the spirit of the law, if not the letter.

But in this case, they obviously just went, okay, you don't want to be a customer, fine.

GRAHAM CLULEY

It would've made more sense if they'd said, we held a séance in order to try and determine who people are who might have been customers of ours in the past, but then requested to have our details completely eradicated.

And that's how we came up with your email address.

Rather than, yes, even though we said we were completely deleting all of your information, we just kept a little bit here in this nook and cranny in case In case there's something embarrassing which happens later.

PAUL DUCKLIN

I don't want to downplay the fact that they were breached and this is unlawful and sending a message to all their customers is not acceptable.

And if the people who did that get caught, they should expect to have the book thrown at them.

I'm not justifying it, even though it was sort of funny in a way, but I just think their response is everything that's wrong with our apparent corporate collective willingness to just shrug off breaches.

GRAHAM CLULEY

So what should they have said? What's got your beef really here, Duck? How should this have been communicated?

PAUL DUCKLIN

I think it's just that reading that email, doesn't it seem to you that it's kind of very casual about, almost as though they want to say, well, somebody got in, but they didn't really get anything important.

So hey, we know you're uncertain. No, I'm certain there was a breach. You're telling me there's a breach. I'm not— there's no uncertainty about that.

And they're saying things like, oh, the affected platforms were immediately locked down, ensuring that no further information could be accessed, and a full investigation was launched.

And then it goes on to say that our investigation found that the unauthorized party had access to some personal information, including names and contact details and certain non-personal account-related information.

Like your search history. How is that non-personal?

And contact details, apparently, according to what I've read on the BBC, who seem to have checked this out, includes phone numbers, home addresses, and these search terms.

So it's not like they got a scan of your driving license. Let's be honest. I'm not saying that's the case.

GRAHAM CLULEY

No.

PAUL DUCKLIN

But in what world does collecting somebody's home address so you can deliver them stuff and then leaking that to the world Just kind of count as I shrug it off. It doesn't matter.

It does matter, particularly if you've ever been stalked or if you've just moved because you felt vulnerable where you were, or just the fact that they said they were going to look after the data and they jolly well should have.

And then they say the ASOS website and app was safe to use throughout and remains safe to use today.

Now, call me cynical, But if I'm using your app, Graham, and somebody figures out a way to send unauthorized messages via that app with the apparent legitimacy of the original company, how is the app safe?

Okay, there's no vulnerability in the app or there's no exploit in the app, but the app is part of a system and can't be disentangled from it.

Unknown

Mm-hmm.

PAUL DUCKLIN

So I hope I don't sound like I'm, well, particularly talking to you, preaching to the choir too much here, but I just don't think that that kind of terminology tells the full truth about what happened.

GRAHAM CLULEY

What it feels like it is to me is this is actually a message to the media saying, no story here. Please stop writing about this. Please stop creating headlines about this.

You are damaging our sales. People may be turning away. This is about damage limitation, isn't it?

PAUL DUCKLIN

Yes.

And making it sound as though, well, it was so trivial because all they know is where you live and what your phone number is and your date of birth and what particular things you're interested in.

And they had access to the app and could have sent you messages that were much more worrying or disconcerting than just making us look bad.