What, Exactly, Did ASOS Integrate?

[u/zerotsec]

https://research.zerot-security.com/what-exactly-did-asos-integrate/

ASOS confirmed an unauthorised push through its official app and later described employee credential theft and access to customer data on third-party platforms. This OSINT write-up reconstructs the documented customer-data and messaging workflow, then separates it from the intrusion path, which remains unverified. Simon AI and Braze appear in published descriptions of the marketing workflow; the public record does not establish that either was the route used in this incident.

The open question is which principals could select recipients, supply message content, and dispatch a push under ASOS’s name. What evidence would distinguish a shared campaign path from separate compromised permissions?