The ASOS cyber incident has highlighted how quickly a compromised identity can develop into a significant data security and communications challenge, particularly when attackers gain access to trusted third-party systems.
On 6 October 2026, ASOS customers received an unauthorised notification through the retailer’s app claiming that the company had been hacked. The attackers also threatened to release stolen information unless the company engaged with them.
Two days later, ASOS confirmed that an unauthorised party had impersonated a trusted contact to obtain an employee’s login credentials. Those credentials were subsequently used to access information held on third-party platforms used by the retailer.
The incident has also raised concerns about the extent of the information accessed. BBC reporting on 8 October indicated that the stolen data included names, addresses, telephone numbers, email addresses, customer numbers and search histories, with potentially millions of customer profiles affected.
ASOS has stated that payment card information and account passwords were not compromised, and that its website and app remained safe to use. The investigation is continuing.
For businesses, the incident raises important questions about identity protection, third-party security, incident response and what happens when attackers attempt to take control of the public narrative.
Respond While Establishing the Facts
When a potentially serious cyber incident occurs, investigation and containment need to happen simultaneously.
Speaking to TechRound following the initial ASOS incident, Peter Moorhead, CTO at Amicis Group, explained that organisations should initially work on the assumption that systems may have been compromised while simultaneously establishing the facts.
The reason is straightforward.
Waiting for complete certainty can give an attacker additional time to move through systems, access further information or disrupt critical services.
Immediate priorities can include:
- Isolating potentially affected systems.
- Preventing lateral movement through the network.
- Revoking access and rotating compromised credentials.
- Restricting unnecessary permissions and third-party connections.
- Preserving evidence to establish what happened and determine the extent of the compromise.
The confirmed theft of employee credentials in the ASOS incident demonstrates why this approach matters.
An attacker does not necessarily need to exploit a sophisticated technical vulnerability to gain access to sensitive information. Sometimes, persuading someone to disclose a trusted identity is enough to establish an initial foothold.
The objective is not to make assumptions about the scale of an incident. It is to limit potential damage while the investigation establishes what has actually occurred.
When a Cyber Attack Becomes a Communications Incident
The ASOS incident had another unusual element.
Attackers appeared to use a trusted customer communication channel to send messages directly to customers, publicly announcing their claims before the investigation had established the full extent of the incident.
This creates a particularly difficult situation for any organisation.
A cyber incident is no longer taking place solely within its technology environment. Customers are aware of it, claims are circulating publicly and the business faces immediate questions from customers, journalists, regulators and other stakeholders.
Importantly, the attacker may be attempting to influence how the incident is understood before the organisation has established the facts.
The response therefore needs to extend beyond the security team.
Security, legal, communications and senior leadership teams must be able to coordinate their activities, ensuring that technical containment continues while external communications remain accurate and measured.
The developing ASOS story illustrates the importance of distinguishing between what attackers claim, what an organisation initially understands and what subsequent investigation confirms.
Businesses need to communicate clearly and promptly, while acknowledging that an investigation may uncover further information.
Trust is built not by claiming certainty too early, but by demonstrating that an incident is being taken seriously, investigated thoroughly and managed responsibly.
Identity Security: A Critical Line of Defence
One of the most significant developments in the ASOS investigation is the confirmation that attackers obtained employee login credentials by impersonating a trusted contact.
This is a form of social engineering, where attackers exploit human trust rather than relying solely on technical weaknesses.
Once credentials have been obtained, attackers may be able to access systems and applications using apparently legitimate identities.
This creates challenges for traditional security controls because activity originating from a compromised account can initially resemble authorised behaviour.
The implications can extend well beyond a single employee account.
An identity with excessive permissions, access to multiple applications or connections to sensitive third-party platforms can potentially provide an attacker with a much wider opportunity.
Organisations therefore need to understand not just whether an account has been compromised, but what that account can access.
Effective identity security should include:
- Strong authentication controls, including phishing-resistant multi-factor authentication where appropriate.
- Least privilege access, ensuring users and applications have only the permissions they require.
- Continuous monitoring for unusual login behaviour and suspicious account activity.
- Controls to identify compromised credentials and unauthorised access.
- The ability to revoke access rapidly across connected systems and applications.
Security awareness also remains important. Employees need to recognise attempts to impersonate colleagues, suppliers and other trusted contacts, particularly when requests involve login credentials or access permissions.
The wider lesson is that identities must be treated as a critical part of an organisation’s security perimeter.
Cloud Security Is Often About Access
The attackers initially claimed to have compromised ASOS’s Snowflake environment, a cloud-based data platform.
That claim should be distinguished from the confirmed findings of the investigation. The reporting to date does not establish that Snowflake’s underlying platform was breached.
However, the confirmed compromise of employee credentials in the ASOS incident demonstrates why this approach matters.
Cloud environments themselves should not automatically be considered inherently unsafe.
Their security depends heavily on how organisations manage access to the services, applications and data they contain.
Compromised credentials, excessive privileges and poorly controlled third-party access can provide attackers with opportunities regardless of whether systems are hosted in the cloud or on-premise.
Third-Party Access Needs the Same Scrutiny
Modern technology environments are highly interconnected.
Businesses increasingly depend on cloud platforms, software providers, applications and external partners to deliver everyday services.
Each connection can potentially create another access path.
The ASOS incident demonstrates why third-party access deserves particular attention. The attackers reportedly used compromised employee credentials to reach information held on external platforms used by the retailer.
Third-party security therefore cannot be treated simply as a supplier procurement or compliance exercise.
Organisations should understand:
- Which third parties and applications can access critical systems.
- What permissions those connections have.
- Whether those permissions are still required.
- How users and applications are authenticated.
- How unusual access or data activity would be identified.
Access that was appropriate when a service was first introduced can gradually become excessive as systems, roles and relationships change.
Continuous visibility is therefore important.
Businesses need to understand their technology dependencies and the potential consequences if an identity or connection is compromised.
Stolen Personal Data Creates Further Risks
Another important development is the growing understanding of what customer information may have been accessed.
While ASOS has said that payment card information and account passwords were not compromised, the reported exposure of contact details, customer numbers and search histories raises concerns of its own.
Personal information can be valuable to cyber criminals even when it does not include payment credentials.
Names, contact details and information about previous interactions with a business can potentially be used to make fraudulent communications appear more convincing.
For example, an attacker with access to customer information may be better placed to impersonate a legitimate organisation through a phishing email, text message or telephone call.
This means the consequences of a data breach can extend beyond the initial incident.
Organisations need to consider not only whether sensitive systems have been accessed, but also how stolen information could subsequently be used against customers, employees or business partners.
Clear customer communications and appropriate guidance can therefore form an important part of the wider incident response.
Cyber Resilience Means Being Ready Before an Incident
Major cyber incidents rarely allow organisations the luxury of designing their response after an attack has started.
Technical containment, investigation, regulatory responsibilities, customer communications and executive decision making may all need to happen simultaneously.
Preparation makes that response considerably easier.
Incident response plans should clearly establish who is responsible for technical containment, communications, legal and regulatory decisions, and executive oversight.
They should also be tested against realistic scenarios, including compromised credentials, third-party access and incidents that become public before the facts are fully understood.
Organisations should understand how quickly they can isolate systems, revoke access, rotate credentials and establish what activity has taken place across their environment.
This is where continuous security monitoring, effective detection and a coordinated response capability become particularly valuable.
The ability to identify suspicious behaviour early, investigate it in context and respond quickly can significantly reduce the opportunities available to an attacker.
Just as importantly, having visibility across identities, cloud environments, endpoints and connected applications helps security teams understand whether an isolated event is part of a wider compromise.
The objective of cyber resilience is not to assume every incident can be prevented.
It is to ensure that when something does happen, the organisation can identify it quickly, contain it effectively and continue operating while the facts are established.
The ASOS incident illustrates why this matters.
A compromised identity, access to third-party information and an attacker-controlled customer notification combined to create a situation involving security, privacy, communications and customer trust.
These are not separate business challenges. They are increasingly interconnected elements of cyber resilience.
For organisations, the most important question is not simply whether their systems are protected, but whether they have the visibility, controls and response capability to act effectively when those protections are challenged.
Expert Commentary from Amicis Group
Want to Read More?
Peter Moorhead, CTO at Amicis Group, discussed the initial ASOS incident alongside other cyber security specialists in TechRound, highlighting the importance of rapid containment while organisations establish the facts.
His observations remain particularly relevant following the latest developments, which reinforce the importance of identity security, third-party access management and coordinated incident response.
Read the TechRound article:
https://techround.co.uk/cybersecurity/asos-customers-received-a-hacked-alert-in-their-app-what-should-businesses-do-when-attackers-go-public/
Read the BBC’s latest reporting:
https://www.bbc.co.uk/news/articles/c3zxjdw5ywgpo
Discover Amicis Group’s Managed SOC Services
https://amicisgroup.co.uk/services/soc-services/
