Most people picture a cyber attack as someone in a hoodie breaking through a firewall. The ASOS breach is a useful reminder that the easiest way in is often a convincing message or phone call to the right person. The attackers didn’t need to break in. They logged in. Here’s what has been reported so far, and what it means for UK small businesses and charities, with no daft jargon.
What happened?
At around 10am on Tuesday 6 October, ASOS app users received a push notification: “Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it.” It linked to a Telegram channel (BBC News).
Later that day ASOS told the London Stock Exchange that “basic personal information including name and contact details may have been accessed”, and that it did not believe payment-card information or account passwords were affected (ASOS RNS). Its shares closed down 9.56% (The Guardian).
On 8 October ASOS emailed customers to explain how it happened: an unauthorised party gained access to an ASOS employee account “by impersonating a trusted contact to obtain log-in credentials”. Those credentials were used to access information on “certain third-party platforms used by ASOS”, which have been locked down. ASOS says it is working with law enforcement and regulators (Computer Weekly).
The same day, the BBC revealed that the criminals had sent it a sample of the stolen data, showing far more than basic contact details: names, addresses, phone numbers, email addresses, customer numbers, dates of birth and the searches customers had made on the website. ASOS then confirmed to customers that data profiles had been taken, but said no bank details or passwords were accessed (BBC News).
The National Cyber Security Centre (NCSC) says ASOS customers should assume they are affected, even if they didn’t get the notification, and watch for suspicious messages, which can arrive some time after a breach (NCSC).
What we still don’t know
ASOS has not said how many customers are affected. The BBC describes the stolen profiles as covering “potentially millions” of users (BBC News), and ASOS says it has 16.5 million active customers worldwide (ASOS RNS), but that is not a confirmed figure for this breach.
The group calls itself Xuanyewen or Xuanye Group and appears to be new (The Guardian). It claims it got in through Simon AI, a marketing platform built on Snowflake. ASOS hasn’t named the platform, and Snowflake says the incident was not caused by any weakness in its service (Infosecurity Magazine). Researcher Kevin Beaumont claims Simon AI didn’t require multi-factor authentication by default; that is also unconfirmed (BankInfoSecurity). The group reportedly gave ASOS two weeks to make contact and wants a ransom to delete the data (Malwarebytes).
On 6 October the Information Commissioner’s Office (ICO) said it had not yet received a breach report from ASOS, noting the 72-hour reporting rule (MLex). The next day its chief executive urged people to be wary of links and change passwords only via the official website or app (ICO). Whether the ICO has opened a formal investigation hasn’t been made public. Law firms are inviting customers to register for possible compensation claims (Thompsons Solicitors), but no group action has been confirmed.
Why this matters to you: attackers target people
ASOS has a security team. None of that helped once a criminal had a real member of staff’s login, because to the systems the attacker looked like that person. Small organisations are no different.
1. How social engineering works
Social engineering means tricking a person into sharing a password, approving a login or resetting an account. The attacker poses as someone you trust, such as a colleague, supplier or your IT support, and adds pressure. A common version is help-desk impersonation: ringing IT support as a member of staff and asking for a password or MFA reset. After last year’s retail attacks, the NCSC told organisations to review how their help desk checks who is calling before resetting passwords, especially for privileged accounts (NCSC).
2. Use phishing-resistant MFA and passkeys
Multi-factor authentication (MFA) is one of the best defences, but not all MFA is equal. A code sent by text or shown in an app can be tricked out of someone over the phone or on a fake login page. Passkeys and hardware security keys are tied to the genuine website, so there is nothing to read out or type into a fake one. The NCSC recommends using passkeys wherever they are offered (NCSC). Use MFA on every system holding customer data, not just email.
3. Give people only the access they need
This is called least privilege. If a marketing login can download your whole customer database, one stolen password becomes a full-blown breach. Review who can export customer data, remove old accounts and suppliers, and keep admin accounts separate from everyday ones.
4. Verify before you reset or grant access
Write down a simple rule: no password reset, MFA change, new access or change of bank details happens on the strength of a call, email or chat alone. Call back on a number you already hold, and make it clear nobody gets in trouble for checking.
5. Train people, then practise
A short, friendly awareness session plus occasional realistic phishing drills builds the habit of pausing. The goal isn’t to catch people out; it’s to make reporting a suspicious message feel normal.
When a supplier you use is breached
Your staff and volunteers may well be ASOS customers, and any supplier you use could be next. When that happens, expect convincing phishing that uses your real details. A message that knows your name or order history isn’t proof it’s genuine. Never act on an unexpected request to log in, pay or “verify”; go to the website yourself or ring a number you already know. Forward scam emails to report@phishing.gov.uk (NCSC) and scam texts to 7726.
The UK GDPR angle: the 72-hour clock
If you hold customer, donor or member data, you’re responsible for it, even in a supplier’s cloud system. The ICO says a reportable personal data breach must be reported to it without undue delay and, where feasible, within 72 hours of becoming aware of it. You can report before you have all the facts; if a breach is unlikely to put anyone at risk, record why you didn’t report (ICO). If the risk to people is high, you must tell them promptly too.
Your social engineering checklist
- Turn on MFA everywhere, starting with email, admin accounts and any system holding customer data.
- Move to passkeys or security keys for admins and finance staff where you can.
- Review who can see and export customer data, and remove old accounts and access nobody needs.
- Write a call-back rule for password resets, MFA changes, access requests and payment changes.
- Run a short staff awareness session, then a phishing drill a few times a year.
- Make reporting easy: one button or address for anything suspicious, and thank people who use it.
- List your key suppliers and trusted numbers to check messages from them.
- Know your 72-hour plan: who decides whether to report to the ICO, and how.
References
- BBC News, “Asos hackers took more personal details than first revealed, BBC finds”, Joe Tidy, 8 October 2026
- BBC News, “What can I do to protect myself after ‘Asos hacked’ message?”, Jemma Crew and Laura Cress, October 2026
- National Cyber Security Centre, “Incident affecting ASOS customers”, 6 October 2026 (updated 8 October 2026)
- ASOS plc, “Update regarding cyber incident”, London Stock Exchange announcement via Investegate, 6 October 2026
- The Guardian, “Asos warns customer data may be compromised after ‘unauthorised’ app access”, Sarah Butler and Dan Milmo, 6 October 2026
- Computer Weekly, “Scope of Asos data breach wider than first reported”, Alex Scroxton, 8 October 2026
- Infosecurity Magazine, “ASOS Confirms Data Breach Linked to Stolen Employee Credentials”, Kevin Poireault, 8 October 2026 (updated 9 October)
- Malwarebytes, “ASOS breach update: Hackers stole customer details and shopping searches”, Pieter Arntz, 9 October 2026
- BankInfoSecurity, “Asos Hackers Claim Breach of Snowflake-Connected Simon AI”, Mathew J. Schwartz, 9 October 2026
- MLex, “No Asos report of potential breach after app notification, UK ICO says”, Patricia Figueiredo, 6 October 2026
- Information Commissioner’s Office, “ASOS statement”, Paul Arnold, 7 October 2026
- Information Commissioner’s Office, “72 hours – how to respond to a personal data breach”
- National Cyber Security Centre, “Incidents impacting retailers – recommendations from the NCSC”, 4 May 2025
- National Cyber Security Centre, “Passkeys: what you need to know”
- National Cyber Security Centre, “Phishing scams: how to spot and report them – report a scam email”
- Thompsons Solicitors Scotland, “ASOS data breach claims” (law firm information page)
Need a hand applying any of this to your business? Get in touch — call +44 1472 564538 or email services@msl.org.uk.