GetSOC2

ASOS breach started with a connected marketing platform

October 13, 2026. From issue 10 of The Compliance Brief, one story for companies buying a SOC 2 audit.

Last reviewed 2026-10-13Written by Jacob Masse, TrazTech Inc.

Issue 10 of The Compliance Brief was published on October 13, 2026. One of its 5 stories bears on SOC 2 audits, auditors and vendor reviews, and they are below in short form. The full issue, with every take in full, is on traztech.ca.

Source: Dark Reading

ASOS confirmed a breach after attackers sent rogue push notifications to customers through its mobile app. Reporting ties the compromise to a third-party communication platform and stolen employee credentials.

Our take, in short

The tool that did the damage was not built by ASOS, and that distinction will not help them with customers or regulators. When we run SOC 2 or ISO readiness, the subprocessor inventory is almost always the weakest document in the folder, usually assembled from memory the week before fieldwork.

Read the full take on traztech.ca

Also in issue 10

Outside SOC 2 audits, auditors and vendor reviews, but in the same email:

Older: issue 9 All issues on GetSOC2