A recent cyber security incident involving online fashion retailer ASOS highlights how social engineering remains one of the most effective ways for threat actors to access corporate data. Here is a clear look at what has been confirmed, what reporting has revealed, and what UK businesses can learn from the breach.
As e-commerce companies scale, protecting access to third-party platforms and internal data repositories becomes a primary operational challenge. When legitimate credentials fall into the wrong hands, attackers can quietly access sensitive information without triggering traditional security alarms.
How the Attack Occurred
According to official statements from ASOS, an unauthorised person impersonated a trusted contact to obtain an employee’s login credentials, then used them to access information on third-party platforms used by ASOS.
The attackers claimed that data was taken from an ASOS Snowflake environment via Simon AI, a marketing platform. Snowflake said its platform had not been breached. ASOS has not publicly confirmed the attackers’ account of the route used, and the investigation is ongoing.
What Information Was Reported Exposed
Information reported as accessed through third-party platforms used by the retailer includes:
Reported Scope of the Data
- ASOS Statement: ASOS said information accessed included names and contact details, as well as certain account-related information.
- BBC Reporting: The BBC later reported that a sample of data provided by the attackers included addresses, phone numbers, email addresses, customer numbers, dates of birth, and website search histories.
- Financial Data Unaffected: ASOS said its investigation had found no evidence that payment-card information or account passwords were accessed.
Incident Response and Regulatory Guidance
ASOS said it had locked down the affected platforms, launched an investigation with internal and external cyber experts, and was working with relevant law-enforcement and regulatory authorities. Its public statement did not identify the regulator by name.
Under UK GDPR rules, a controller must notify the Information Commissioner's Office (ICO) without undue delay and, where feasible, within 72 hours when a personal-data breach is likely to result in a risk to people’s rights and freedoms. If a breach is likely to result in a high risk to individuals, affected people must also be informed without undue delay so they can take steps to protect themselves against secondary risks such as targeted phishing.
Key Cyber Security Lessons for UK SMEs
While every incident is unique, this incident underscores broader security principles that small and medium-sized businesses can use to harden their security posture:
- Verify Unusual Communications: Establish out-of-band verification procedures for any request involving account access, credential resets, or administrative permission changes.
- Enforce Principle of Least Privilege: Restrict user permissions on third-party SaaS platforms so that compromised credentials cannot access broader data stores.
- Conduct Continuous Security Training: Educate staff continuously on current social-engineering tactics, emphasizing impersonation red flags across all communication channels.
- Audit Third-Party Data Access: Review which third-party platforms hold sensitive customer data and monitor user login logs and system activity for anomalous access or unusual data downloads.
Secure Your Cloud and Application Infrastructure
We help UK organisations evaluate access controls, audit third-party system configurations, and build resilience against social engineering.
Neil Campbell is owner and operator at SME Cyber Solutions Ltd and a member of the Crimes Against Biz Policy Group for the FSB. He writes about AI, automation and practical technology infrastructure for UK SMEs.