On 6 October 2026, some ASOS customers learnt of a cyber incident in an unusual way: through an unauthorised notification pushed via the retailer’s own app, rather than an official alert from the company. ASOS later reported that an attacker had impersonated a trusted contact to obtain an employee’s login credentials and access information held on third-party platforms. It was reported that customer names and contact details were affected, but payment-card information and account passwords were not.
Strip away the headlines and the incident highlights two connected risks: access to customer data, and the ability to speak in a business’s name. Any organisation using marketing, customer management or notification platforms should be asking itself hard questions about both.
Social engineering exploits trusted access
Social engineering is a con trick, not a hack. It involves manipulating someone into granting access or disclosing information. It can happen through emails, calls or messages appearing to come from colleagues, suppliers or other trusted contacts in order to obtain credentials or access, and it can be remarkably convincing.
Here is the uncomfortable truth: an attacker using valid credentials can gain access without exploiting any software vulnerability at all. That makes people, not just systems, the real control point. Staff need reliable procedures for verifying unusual requests, particularly password resets and changes to access permissions, along with clear routes for reporting concerns.
Multi-factor authentication (MFA) requires more than one form of verification and provides a further safeguard, though its design matters. Some methods remain vulnerable to phishing, while phishing-resistant options offer stronger protection. Businesses should also restrict who can export customer data, change account access or send communications on their behalf.
The available reports currently do not confirm whether MFA was absent or bypassed at ASOS, and access gained through stolen credentials does not, by itself, establish a vulnerability in a platform provider’s technology.
Outsourcing the task does not outsource the risk
Handing data processing to a supplier can feel like handing off the risk too. But it is not that simple. A business that decides why and how personal data is processed will generally be its controller, and outsourcing the processing does not remove its responsibilities, although processors also carry their own legal duties.
Modern businesses increasingly depend on third-party platforms for customer engagement, marketing, data analytics and communications. Access to a single platform account can create risks extending beyond the underlying data itself, including the ability to send messages, influence customer behaviour or undermine trust in official communications.
Where a supplier processes data on a business’s behalf, the business must assess the supplier’s safeguards and put appropriate contractual terms in place. This due diligence should extend beyond initial procurement to ongoing access reviews and incident preparedness.
Practical questions include:
- who can download data;
- who can send customer messages; and
- who can disable access urgently.
Supplier agreements should address escalation contacts, prompt breach notification and access to investigation evidence. Businesses should also routinely remove information and permissions that are outdated or no longer needed by platforms.
When the breach hits, IT, legal and communications need to move as one
Once an incident is detected, the immediate priorities are containing unauthorised access, preserving relevant evidence and establishing what information and systems are affected.
A clear owner should coordinate the response and record decisions as they are made. If the usual customer communication channel is compromised, the business also needs an independently verified route for updates. Being able to identify who accessed a system, when it occurred, and what actions were taken via audit logs could significantly reduce investigation time and assist both regulatory reporting and customer communications.
Rehearsing these decisions before an incident helps teams respond consistently, with technical containment, legal assessment and public messaging progressing together rather than in sequence.
When must the ICO and customers be notified?
Here is a point worth remembering: unauthorised access to personal data can constitute a breach even without evidence that any information was downloaded.
Under the UK GDPR, controllers must notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless the breach is unlikely to create a risk to individuals’ rights and freedoms. Where a high risk is likely, affected individuals must also be informed without undue delay.
Processors must inform their controller without undue delay, and all breaches and reporting decisions should be documented. Organisations need not wait for a completed investigation before making a required notification: further information can follow in phases.
“No payment details stolen” is not the reassurance it sounds like
Do not be fooled by the absence of stolen card numbers: names and contact details alone can support remarkably convincing scams, even where passwords and payment information remain secure. An Individual who suffers financial loss or distress because an organisation breached data-protection law may be entitled to compensation, but liability is not automatic: the claimant would need to establish the infringement, the harm suffered and a causal connection between the two. A scam occurring after a breach does not, by itself, establish that connection.
Businesses should assess the risk of follow-on fraud and give customers timely, practical warnings. The absence of stolen payment details does not eliminate the potential for financial harm or legal exposure.
Customer communications should explain what is known, what remains under investigation, and how individuals can protect themselves. Premature reassurance should be avoided: trust, once broken, is only rebuilt with accurate information and demonstrably secure channels.
The key lesson to take away from the ASOS incident is that cyber risk increasingly stems not only from technical vulnerabilities and weaknesses but also from trusted relationships, third party platforms and the human decisions that govern them.
Quastels’ Data Protection & Privacy team advises on supplier contracts, incident preparedness and breach response, helping businesses connect legal obligations with practical, workable controls. If you have any questions, please do not hesitate to get in touch.
