The ASOS cyberattack incident highlights, once again, the delicate balance between people, digital identities, third-party platforms and customer trust. For risk managers, the challenge is understanding the organisation’s cyber risk exposure whilst working alongside IT and Security teams to ensure that intrusion opportunities are not only minimised , but also be prepared to respond when a breach occurs to reduce impact and keep the ‘lights on’, in a word: Resilience.
An online retailer can remain open for business while losing control of an important part of its customer relationship. That is one of the most significant lessons emerging from the recent ASOS cyberattack.
On 6 October, ASOS confirmed that an unauthorised notification had been sent to customers through its app. The company said it was investigating activity involving third-party platforms used for customer communications and had restricted access to those platforms. Its website and app continued operating, with no disruption to its operations reported at that stage[i].
In an update to customers on 8 October, reported by Reuters, ASOS said an attacker had impersonated a trusted contact to obtain an employee’s login credentials. Those credentials were then used to access information on certain third-party platforms. The company said the attacker had access to customers’ names and contact details, alongside other account-related information, but that no payment card information or account passwords had been accessed[ii].
The emerging picture should not be treated as a completed assessment of ASOS’s security arrangements. Its investigation remains ongoing, and the public account does not establish precisely which controls were in place, bypassed or ineffective. The measures discussed below are therefore lessons for managing this type of exposure, rather than claims about safeguards ASOS failed to implement[iii].
Look beyond the individual employee
Because the incident involved impersonation, it should be understood as a social engineering attack. Framing it simply as “human error” would mischaracterise the threat and understate the security implications.
The more useful question is how an organisation ensures that a convincing deception does not become a successful intrusion. Employees need clear procedures for checking unusual requests, particularly those involving login credentials, account recovery or changes to access. Verification should use an independently established route, rather than contact details supplied within the suspicious request.
Training is part of that defence, not the whole of it. The National Cyber Security Centre (NCSC) explicitly warns against placing too much emphasis on employees spotting phishing attempts. It recommends a layered approach combining people, processes and technology, alongside a culture in which staff can report mistakes without fearing punishment[iv].
For risk managers, this changes the assurance question. Asking whether everyone has completed annual training is less useful than asking, or indeed verifying through phishing simulations, whether employees can challenge a plausible request, obtain support quickly and report a suspected compromise immediately.
Technological authentication controls can also help reduce dependence on individual judgement. Phishing-resistant multi-factor authentication, such as FIDO2 security keys[v], offers stronger protection against credential phishing than passwords or one-time codes alone. A £30 YubiKey[vi] could have saved ASOS A world of pain. Organisations should prioritise strong authentication for accounts with access to customer information, administration tools and external platforms. This significantly reduces exposure to the reported type of attack, although the available evidence does not establish how ASOS’s authentication controls were configured. Better still would be to follow NCSC’s latest guidance on passkeys and do away with passwords completely[vii].
Bring third-party platforms into the risk assessment
ASOS’s account also reinforces an important distinction: unauthorised access to an organisation’s use of a third-party service does not, by itself, demonstrate that the provider’s underlying technology was breached. The reported entry point was an employee account, followed by access to external platforms.
The practical lesson is that supplier assurance and internal access management must work together.
Organisations should map which services hold customer information, which can communicate with customers, and which identities connect those services. Each should have a named business owner and a clear allocation of security responsibilities between the organisation and its provider. NCSC guidance recommends understanding these responsibilities, obtaining evidence of suppliers’ security arrangements and including important partners in incident-response exercises[viii].
Risk profiling should reflect what a platform can do, rather than simply its contract value. A relatively inexpensive communications tool may deserve significant scrutiny if it can reach a large customer population.
Contracts should also establish incident-reporting timescales, escalation contacts and the support each party will provide. Those arrangements need to be usable during a crisis, not merely present in procurement documentation[ix].
Limit the consequences of compromised access
Preventive controls cannot remove every possibility of account compromise. A second line of defence must limit what an attacker can do after gaining access.
The principle of least privilege means giving each account only the permissions necessary for its role. Access should be reviewed when responsibilities change, rather than accumulating indefinitely. The Center for Internet Security notes that role‑based permissions, strong authentication, and timely access revocation are core safeguards. CIS has long argued that effective implementation of these foundational controls can prevent a large proportion of common attacks[x].
Applied to a customer-facing business, this suggests separating the ability to view customer records, export information, administer a platform and send large-scale communications. Organisations should consider independent approval for particularly consequential actions, such as an unusual mass notification. These are proposed safeguards: their suitability depends on the platform and the organisation’s operating model.
Data minimisation provides another opportunity to reduce potential harm. Risk managers should challenge whether every external platform needs a complete customer record, how long information must be retained and whether less identifying data would meet the business purpose. Data classification, retention controls and separation according to sensitivity are central elements of the CIS data-protection framework[xi].
The absence of payment-card exposure should not end the impact assessment. In its ASOS alert, the NCSC warned customers to watch for suspicious messages, including those arriving sometime after the incident. Contact information can still create opportunities for follow-on scams[xii].
Detect misuse and rehearse containment
Organisations need to monitor what authenticated accounts do, not merely whether a login succeeds.
For a comparable scenario, useful warning signs could include unusual data exports, unexpected permission changes or customer messages sent outside established workflows, or activity occurring at atypical times — such as account actions late at night, during periods of inactivity, or immediately after access changes.
These should inform a proportionate monitoring strategy, with clear ownership of alerts. CIS guidance stresses that collecting logs is insufficient without review and analysis; those records also help establish what information was accessed and whether it was removed[xiii].
Containment procedures should be equally practical. Teams should know how to disable compromised access and terminate active sessions across affected services. A password reset should not be assumed to have removed every existing connection: NCSC account-recovery guidance treats changing passwords and logging out connected devices and applications as separate steps[xiv].
A useful exercise for risk managers would begin with a straightforward scenario: an employee account is compromised, customer data may have been accessed, and an unauthorised message has already reached customers. The exercise should test who can suspend communications, obtain supplier support, preserve evidence and authorise public updates. Addressing all the above points in a time of crisis is too late; for accessible tabletop exercises, look at NCSC tabletop exercises, which are structured, discussion-based simulations that help organizations test and improve their cyber incident response in a safe, controlled environment.[xv]
Treat communications as part of the response
When an incident reaches customers through an organisation’s own app, communications cannot be treated as something that follows the technical investigation. In the ASOS incident, the unauthorised notification itself became part of the event the company had to address[xvi].
Organisations should prepare an alternative, verified route for updates in case a normal communications channel is compromised. Early statements should distinguish what is confirmed, what remains under investigation, what customers should do and when further information will be provided.
The NCSC’s incident-communications guidance recommends preparing in advance and warns against assurances that may become problematic as an investigation develops. A statement that no evidence of a particular impact has yet been found is not the same as a definitive conclusion that it did not occur[xvii].
Regulatory assessment must proceed alongside that communication. In the UK, notifiable personal data breaches must be reported to the ICO without undue delay and, where feasible, within 72 hours of awareness. Where a breach is likely to create a high risk to individuals’ rights and freedoms, those individuals must also be informed without undue delay. Organisations need not wait for a completed forensic investigation before making an initial notification[xviii]. One interesting point is that ASOS continued operating despite this incident. This raises the question of whether business resilience should be measured only by service availability or also by the ability to maintain control over customer information, communications, and trust.
Post‑incident review must follow closely behind containment and notification. Organisations should document the sequence of events, identify control gaps and assess whether existing safeguards operated as intended. Lessons learned should feed directly into updates to risk profiling, assurance activities and monitoring priorities, ensuring that weaknesses exposed by the incident are not allowed to persist. Effective review is not limited to technical findings; it should also examine decision‑making, escalation pathways and communication processes to strengthen organisational readiness for future attacks.
Turn the lessons into board-level assurance
For boards and chief risk officers, the central challenge is to translate these controls and their current implementation status into evidence that risk is being managed.
The UK’s Cyber Governance Code of Practice calls for senior ownership of cyber risk, integration with enterprise risk management, a defined risk appetite and proportionate assessment of suppliers. It also emphasises incident preparedness and assurance over the organisation’s approach[xix].
A practical response would be to request a small set of measures: the proportion of high-impact accounts protected by phishing-resistant authentication; outstanding access-review findings; coverage of monitoring across critical external platforms; and the time taken in exercises to revoke access and issue a verified customer update. Each weakness should have an owner, a remediation deadline and an explicit decision about any risk accepted in the meantime.
The speed at which digital threats are evolving makes it essential to reassess how organisations establish trust. AI-assisted phishing, voice cloning and deepfake video can make impersonation increasingly convincing, enabling attackers to imitate colleagues, suppliers or senior executives without many of the obvious warning signs associated with traditional scams. For risk managers, this means treating a familiar name, voice or face as insufficient proof of identity and requiring sensitive requests to be verified through independently established contact channels. Organisations should also refresh their threat assessments, test realistic impersonation scenarios and require additional approval for high-impact actions, such as changing account access or exporting customer data. The objective is not to make every employee an expert in detecting deception, but to build safeguards that prevent even a highly convincing impersonation from becoming a major organisational incident.
ASOS also disclosed that it held cyber insurance, including business continuity cover. Risk managers should nevertheless distinguish financial risk transfer from operational control: insurance arrangements do not remove the need to prevent unauthorised access or manage the consequences for customers. The strongest lesson from the ASOS incident is therefore not that organisations should simply train employees more or purchase another security product. It is that they should test the connections between their defences.
The question is not only whether an attacker can obtain an account. It is what that account can reach, how quickly misuse will be detected, and whether the organisation can contain the consequences before they spread.
Authored by the Enterprise Risk Editorial Team, with contributions from Graeme McGibbney, Alex Stezycki and Zhanar Tukeyeva, IRM Cyber SIG.
[i] Update regarding cyber incident – 15:15:21 06 Oct 2026 – ASC News article | London Stock Exchange
[ii] UK’s ASOS says cyber hack accessed customers’ personal data | Reuters
[iii] ASOS confirms customer data accessed following employee account compromise – Intelligent CISO
[iv] Phishing attacks: defending your organisation | National Cyber Security Centre
[v] Multi-factor authentication for your corporate online services | Recommended types of MFA | National Cyber Security Centre
[vi] Best Practices Guide: How to get started with phishing-resistant MFA for Zero Trust | Yubico
[vii] Passkeys: what you need to know | National Cyber Security Centre
[viii] 10 Steps to Cyber Security | Supply chain security | National Cyber Security Centre
[ix] Supply chain security guidance | The principles of supply chain security | II. Establish control | National Cyber Security Centre
[x] CIS Control 6: Access Control Management – CIS Controls Assessment Specification for Controls v8.1
[xi] CIS Control 3: Data Protection – CIS Controls Assessment Specification for Controls v8.1
[xii] Incident affecting ASOS customers | National Cyber Security Centre
[xiii] CIS Control 3: Data Protection – CIS Controls Assessment Specification for Controls v8.1
[xiv] Recovering a hacked account | National Cyber Security Centre
[xv] Tabletop exercises | National Cyber Security Centre
[xvi] Latest information about the unauthorised ASOS notification | ASOS Customer Care
[xvii] Guidance on effective communications in a cyber incident | National Cyber Security Centre
