The recent incidents at ASOS and at several country-code domain registries point to a single operational pattern: attackers are no longer breaching their targets head-on. They are compromising the third parties those targets depend on, then using that inherited trust to reach customers and infrastructure at scale. The lesson for US technology companies and consumers is that the security perimeter now runs through vendors, registrars, and operators that many firms do not control and often do not audit.
The ASOS Breach Was Not a Break-In
ASOS confirmed this week that hackers accessed some customer personal data, and the company is sending updates to affected customers, as BleepingComputer reported. The mechanism was social engineering and credential theft, not a novel exploit or a flaw in ASOS's own systems. That distinction matters. Social engineering against employees or contractors is an access problem that no amount of perimeter hardening fully solves, because the credential, once surrendered, is valid. The attacker does not need to defeat a firewall if a person hands over the key.
The ASOS case also shows how thin the line is between an access compromise and a customer-facing event. According to TechCrunch, the hackers alerted the fashion giant's customers through a push notification that said they had "fully compromised" the company's cloud storage. That is a striking detail: the intruders used ASOS's own notification channel to announce the breach to its customers. The company learned the scope of its exposure, in part, at the same moment its customers did. For US firms running customer-facing apps with push infrastructure, this is the operational reality to plan for. A compromised backend can be turned into an attacker's megaphone, and the brand absorbs the reputational hit.
The Registry Hijacks Extend the Same Logic
The second cluster of stories points at the same underlying model, one layer further out. Hackers obtained unauthorized HTTPS certificates for several Google domains and hijacked domains in the country-code top-level domains for Ghana, American Samoa, and Sierra Leone, as BleepingComputer reported. The method was not an attack on Google directly. It was the compromise of third-party operators, whose authoritative DNS records were then modified.
At first glance, ccTLDs for Ghana, American Samoa, and Sierra Leone look distant from a US technology company's threat model. That reading is wrong. The compromise chain is identical to the ASOS one: attackers target a less-defended party that holds trust on behalf of a larger one, then convert that inherited trust into something valuable. In the ASOS case the prize was customer data and a notification channel. In the registry case the prize was DNS control and valid HTTPS certificates for recognizable domains. Both outcomes depend on a trust relationship the victim did not directly manage and could not easily revoke.
Trust Is the Attack Surface
What unites these incidents is that the attacker's first move is rarely against the primary target. It is against whoever the primary target has delegated something to: a support function that can be socially engineered, a cloud environment reachable with stolen credentials, a registry operator that can modify DNS records. Each of these is a trust relationship, and each is exploitable if the trusted party is weaker than the party relying on it.
For US technology companies, this reframes security spending. The question is no longer only whether a company's own systems are hardened. It is whether every vendor, registrar, and operator in the chain is hardened to the standard the company's brand implicitly promises. Most organizations have detailed visibility into their own infrastructure and far less into the intermediaries they depend on. The incidents above show attackers probing exactly that gap.
